Plugins

12 plugins

Secure Rust Code Review

Installs a pipeline to validate, plan, execute, and enforce a secure Rust code review.

4 skills · plugin

Secure Code Review Pipeline

Installs a pipeline to validate, plan, execute, and enforce a secure code review on PRs.

12 skills · plugin

Testing & Quality

Testing, TDD, code review, linting and debugging.

25 skills · plugin

Secure SQL Review

Installs a pipeline to validate, plan, execute, and enforce a secure SQL code review.

4 skills · plugin

Code Security Review Pipeline

Audit code changes for bugs, security flaws, and quality issues before merging.

15 skills · plugin

Refactor Code Safely

Restructure code while preserving behavior: confirm tests are green, refactor in small steps, keep tests green, review, and commit.

9 skills · plugin

Softnano Plugins

Shared skills for the SoftNano lab — HPC job monitoring, code review, literature search, DOI lookup, and more

13 skills · plugin

AI Shipping Kit — for PMs and founders accountable for AI-built code. Document a vibe-coded app, audit it for intended-vs-implemented security gaps and performance issues, and produce a reviewer-ready shipping packet.

2 skills · plugin

GitHub-specific extensions to Han. Provides skills to post code reviews as PR comments, update a PR description with a consistent format, and other GitHub-facing workflows.

3 skills · plugin

Opinionated plan -> ship -> review workflow for Claude Code. Skills: onboard, plan, ship, watch, fix. Reads per-repo config from CLAUDE.md so the same flow works across every repo.

5 skills · plugin

Portable core of Sam's Claude Code setup: native pre-commit hook enforcement (sentinel gate retired 2026-08-14), on-demand /validate, generic review agents, cross-model Codex review skills, and a /bootstrap-cc-setup skill that writes the always-loaded rules layer plugins cannot ship. For repos NOT bootstrapped by the Loam Copier template - a Loam-rendered project already carries most of this in .c

6 skills · plugin

Business Process

Business process skills (process-optimizer, sop-writer, workflow-mapper, weekly-review). Useful for operational documentation, SOP generation, and workflow analysis. NOT for: software engineering tasks — these target organizational processes, not code.

4 skills · plugin

Results for “code-review”

21 skills

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

12.8k · bundle

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

lucaspmarie-a11y

Runs security audits, threat modeling, and hardening for code and infrastructure, covering OWASP checks, code review, incident response, and red/blue team exercises.

Review local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist-driven process.

Audit Prep Assistant

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

nimoqup046-collab

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, using a structured checklist and verification process.

More results

lucaspmarie-a11y

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, producing a prioritized report with severity ratings and concrete fixes.

Security Review

Scans codebases for security vulnerabilities by reasoning about code context, data flow, and component interactions, covering injection flaws, secrets exposure, authentication issues, and weak cryptography across multiple languages.

36.2k · bundle

Pr Review Expert

Review GitHub PRs and GitLab MRs with structured analysis including blast radius, security scanning, test coverage delta, breaking change detection, and performance impact.

Insecure Defaults

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

cloudflare-security-audit

Finds exploitable vulnerabilities in codebases through a structured multi-phase audit covering recon, hunting, validation, and reporting.

sakamoto-family-smile

Production Audit

Audits a codebase for production readiness using local evidence, scoring ship/block risk and listing concrete fixes without sending repo data to external services.

Runs an evidence-first, read-only workflow over large codebases via an external JSONL REPL server, retrieving only minimal file slices and greps to produce cited architecture and audit reports.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Security Reviewer

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

10.4k · bundle

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

sakamoto-family-smile

Security Review

Provides a security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data handling.

Runs a six-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring guidance.

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team analysis, and a final verdict, with optional Python automation scripts.

Runs a structured 6-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring playbooks.