Plugins

5 plugins

Rulebase Skills

Rulebase Skills from rulebase-co/rulebase-skills.

100 skills · plugin

Everything Claude Code Main

Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, rules, and legacy command shims evolved over 10+ months of intensive daily use

100 skills · plugin

Han Plugin Builder

Guidance for building Claude Code skills, agents, and plugins. The guidance skill answers authoring questions and, run with init, vendors the full guidance set into a repo as a path-scoped rule index so the right guidance surfaces while editing skill and agent files. Opt-in and dependency-free: installed on its own, not pulled in by the han meta-plugin.

3 skills · plugin

The shared foundation of the Han suite: the specialist agent roster the other plugins dispatch, the project-discovery skill with its project-scanner agent, and the canonical evidence and YAGNI rule files. The documentation skills live in han-documentation, the pre-planning research skills in han-research, the planning skills in han-planning, and the coding skills in han-coding; each depends on han

2 skills · plugin

Portable core of Sam's Claude Code setup: native pre-commit hook enforcement (sentinel gate retired 2026-08-14), on-demand /validate, generic review agents, cross-model Codex review skills, and a /bootstrap-cc-setup skill that writes the always-loaded rules layer plugins cannot ship. For repos NOT bootstrapped by the Loam Copier template - a Loam-rendered project already carries most of this in .c

6 skills · plugin

Results for “rule”

166 skills

Securing API Gateway With AWS Waf

Protect API Gateway endpoints with AWS WAF by configuring managed rule groups, rate limiting, bot control, IP reputation filtering, and monitoring.

24.6k · bundle

Implementing Alert Fatigue Reduction

Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.

24.6k · bundle

Performing Threat Hunting With Elastic Siem

Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.

24.6k · bundle

Create and manage Ethereum wallets, including EOAs, smart contract wallets, Safe multisig, EIP-7702, and account abstraction, with AI agent key safety rules and transaction approval thresholds.

Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

20.4k · bundle

Implementing Secret Scanning With Gitleaks

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

24.6k · bundle

Assesses cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Implementing Security Chaos Engineering

Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.

24.6k · bundle

Hunting For Registry Run Key Persistence

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.

24.6k · bundle

Configuring Windows Defender Advanced Settings

Hardens Windows endpoints by configuring Microsoft Defender for Endpoint advanced settings, including attack surface reduction rules, controlled folder access, network protection, and exploit protection.

24.6k · bundle

Detecting Container Runtime Threats With Falco

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

24.6k · bundle

Detecting Network Scanning With Ids Signatures

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

24.6k · bundle

Performing Purple Team Atomic Testing

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

24.6k · bundle

Conducting Post Incident Lessons Learned

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

24.6k · bundle

Implementing Endpoint Detection With Wazuh

Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.

24.6k · bundle

Performing Web Application Firewall Bypass

Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.

24.6k · bundle

Detecting Business Email Compromise With AI

Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.

24.6k · bundle

Implementing Data Loss Prevention With Microsoft Purview

Configures sensitivity labels, DLP policies, and endpoint data protection rules in Microsoft Purview to safeguard sensitive information across Exchange, SharePoint, OneDrive, Teams, and endpoints.

24.6k · bundle

Vikingo Szabvany

Enforces the Vikingo Studio standard for WordPress plugins and repos: naming taxonomy, plugin headers, folder structure, versioning, release flow, private update channel, admin UI rules, security baseline, and pre-release checklist.

Analyzing Kubernetes Audit Logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.

24.6k · bundle

Detecting Misconfigured Azure Storage

Audits Azure Storage accounts for misconfigurations including public blob access, weak network rules, missing encryption, permissive SAS tokens, and disabled logging using Azure CLI, PowerShell, and Defender for Storage.

24.6k · bundle

Detecting Lateral Movement In Network

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

24.6k · bundle

Hunting For Lolbins Execution In Endpoint Logs

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

24.6k · bundle

Developer Code Review Rules

Review pull requests or audit repositories for correctness, security, performance, test risk, architecture, dependencies, developer experience, documentation, and grounded product direction. Use for code review, repository audits, evidence-backed findings, false-positive vetting, risk assessment, prioritization, or deciding which improvements should become implementation plans.

Performing Packet Injection Attack

Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.

24.6k · bundle

Hunting Credential Stuffing Attacks

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

24.6k · bundle

Detecting Ransomware Precursors In Network

Detects early-stage ransomware indicators in network traffic before encryption begins, using Zeek, Suricata, Arkime, SIEM correlation rules, and threat intelligence feeds to identify Cobalt Strike beacons, Mimikatz signatures, and RDP brute-force attempts.

24.6k · bundle

Performing HTTP Parameter Pollution Attack

Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.

24.6k · bundle

Configuring Microsegmentation For Zero Trust

Design and enforce microsegmentation policies using workload identity and label-based rules to prevent lateral movement in zero trust architectures, with guidance for tools like VMware NSX, Illumio, and Calico.

24.6k · bundle

Performing Cloud Native Forensics With Falco

Deploys and manages Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Parses Falco alerts for incident response.

24.6k · bundle

Implementing Purdue Model Network Segmentation

Design and implement network segmentation for industrial control systems using the Purdue Enterprise Reference Architecture model, separating OT and IT networks into hierarchical security zones with strict traffic control.

24.6k · bundle

Cx Collections Conduct

Use to audit arrears, collections and financial-difficulty conversations for fair treatment — forbearance offered, pressure absent, vulnerability recognised. Trigger for "audit our collections calls", "are we treating customers in arrears fairly", "did we offer forbearance", financial difficulty handling, payment plan conversations, or a complaint about collections conduct.

Cx Dispute Quality

Use to audit how payment disputes, chargebacks and unrecognised-transaction claims are handled against scheme deadlines and evidence standards. Trigger for "audit our dispute handling", "chargeback quality review", "are we meeting scheme deadlines", unrecognised transaction claims, provisional credit decisions, or a customer complaining their dispute was rejected unfairly.

Cx Effort Score

Use to measure customer effort from behavioural signals instead of CES surveys, and to audit whether a composite effort score is honest. Trigger for "customer effort score", "behavioural CES", effort without survey, repeat contacts and channel switches, transfers and reopens, or "our CES doesn't match operational data".

Cx Complaint Classification

Use to design or audit complaint identification and classification in customer support, especially in regulated sectors. Trigger for "are we identifying complaints correctly", "complaint detection", regulatory complaint definition, FCA or CFPB complaint handling, vulnerable customer identification, root cause categorisation for complaints, or building an AI classifier for complaints.

Configuring Host Based Intrusion Detection

Deploys and configures host-based intrusion detection systems (Wazuh, OSSEC, AIDE) to monitor file integrity, system calls, and configuration changes across endpoints. Includes FIM policies, rootkit detection, custom alert rules, active response, and SIEM integration.

24.6k · bundle