Plugins

2 plugins

Everything Claude Code Main

Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, rules, and legacy command shims evolved over 10+ months of intensive daily use

100 skills · plugin

Portable core of Sam's Claude Code setup: native pre-commit hook enforcement (sentinel gate retired 2026-08-14), on-demand /validate, generic review agents, cross-model Codex review skills, and a /bootstrap-cc-setup skill that writes the always-loaded rules layer plugins cannot ship. For repos NOT bootstrapped by the Loam Copier template - a Loam-rendered project already carries most of this in .c

6 skills · plugin

Results for “rules”

126 skills

Malware Analysis

Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.

12.8k · bundle

Network Policies Security

Implements Kubernetes network policies for micro-segmentation, covering ingress/egress rules, Calico and Cilium, with a Python CLI for managing and validating policies.

Static Application Security Testing

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.

Detecting Credential Dumping Techniques

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules.

24.6k · bundle

Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.

Extracting Windows Event Logs Artifacts

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

24.6k · bundle

Performing Malware Triage With Yara

Rapidly classify malware samples against known family signatures using YARA rules, covering rule writing, scanning, and integration with analysis pipelines.

24.6k · bundle

Building Incident Timeline With Timesketch

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

24.6k · bundle

Implementing Security Monitoring With Datadog

Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.

24.6k · bundle

Implementing Web Application Logging With Modsecurity

Configure ModSecurity WAF with OWASP Core Rule Set for web application logging, tune rules to reduce false positives, and analyze audit logs for attack detection.

24.6k · bundle

agentskillexchange

Git Secret Scanner

Detects leaked secrets in Git repositories by scanning full commit history with Gitleaks rules and the GitHub Secret Scanning API, identifying exposed API keys, tokens, and credentials.

Yara Rule Authoring

Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.

Implementing Alert Fatigue Reduction

Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.

24.6k · bundle

Performing Threat Hunting With Elastic Siem

Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.

24.6k · bundle

Performing Yara Rule Development For Detection

Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.

24.6k · bundle

Create and manage Ethereum wallets, including EOAs, smart contract wallets, Safe multisig, EIP-7702, and account abstraction, with AI agent key safety rules and transaction approval thresholds.

Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

20.4k · bundle

Implementing Secret Scanning With Gitleaks

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

24.6k · bundle

Assesses cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Hunting For Registry Run Key Persistence

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.

24.6k · bundle

Configuring Windows Defender Advanced Settings

Hardens Windows endpoints by configuring Microsoft Defender for Endpoint advanced settings, including attack surface reduction rules, controlled folder access, network protection, and exploit protection.

24.6k · bundle

Detecting Container Runtime Threats With Falco

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

24.6k · bundle

Detecting Network Scanning With Ids Signatures

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

24.6k · bundle

Extracting Iocs From Malware Samples

Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators, host artifacts, and behavioral patterns for threat intelligence sharing and detection rule creation.

24.6k · bundle

Performing Purple Team Atomic Testing

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

24.6k · bundle

Conducting Post Incident Lessons Learned

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

24.6k · bundle

Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.

12.8k · bundle

Performing Web Application Firewall Bypass

Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.

24.6k · bundle

Implementing Data Loss Prevention With Microsoft Purview

Configures sensitivity labels, DLP policies, and endpoint data protection rules in Microsoft Purview to safeguard sensitive information across Exchange, SharePoint, OneDrive, Teams, and endpoints.

24.6k · bundle

Vikingo Szabvany

Enforces the Vikingo Studio standard for WordPress plugins and repos: naming taxonomy, plugin headers, folder structure, versioning, release flow, private update channel, admin UI rules, security baseline, and pre-release checklist.

Analyzing Kubernetes Audit Logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.

24.6k · bundle

Detecting Misconfigured Azure Storage

Audits Azure Storage accounts for misconfigurations including public blob access, weak network rules, missing encryption, permissive SAS tokens, and disabled logging using Azure CLI, PowerShell, and Defender for Storage.

24.6k · bundle

Detecting Lateral Movement In Network

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

24.6k · bundle

Analyzing Office365 Audit Logs For Compromise

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

24.6k · bundle

Hunting For Lolbins Execution In Endpoint Logs

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

24.6k · bundle

Developer Code Review Rules

Review pull requests or audit repositories for correctness, security, performance, test risk, architecture, dependencies, developer experience, documentation, and grounded product direction. Use for code review, repository audits, evidence-backed findings, false-positive vetting, risk assessment, prioritization, or deciding which improvements should become implementation plans.