Security for Claude Code

Produce a hardening spec and implement it — auth patterns, security headers, rate limiting, input validation, secrets management, dependency hygiene. Use when asked to "harden this", "add security to this service", "what security do I need", or "secure this before launch".

Build IAM from scratch — roles, policies, service accounts with least privilege. Use when asked to "set up IAM", "create roles", "service accounts", or "access control".

Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when asked about "security posture", "how secure is this", or "security assessment".

Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to "threat model this", "what could go wrong security-wise", "map our attack surface", or before designing any security-sensitive feature.

Audit PHP engine deserialization surface (unserialize, session decoders, WDDX, phar metadata, custom ce->unserialize handlers) for UAF, type confusion, partial-object __destruct, signed-length heap overflow, and parse inconsistency.

Capacitor quality skills for testing, debugging, logs, performance, accessibility, and security.

Security tools: Code auditing, vulnerability scanning, compliance checks

Comprehensive testing: E2E, TDD, performance, security testing with multiple frameworks

Abnormal Security - AI-powered email security, phishing detection, account takeover prevention

Blackpoint Cyber / CompassOne MDR - tenants, assets, detections, vulnerabilities (dark web, external, scans)

Blumira - SIEM findings management, device inventory, MSP multi-tenant operations, and security posture analysis

Checkpoint Harmony Email & Collaboration (Avanan) - quarantine, threats, policies, incidents, Smart Banners

Datto SaaS Protection (Backupify) - M365 / Google Workspace cloud-to-cloud backup (scaffolding)

Huntress - managed threat detection, incident response, endpoint agent management, escalations, and billing reports

Inforcer - Microsoft 365 security baseline governance for MSPs: managed tenants, baseline templates, alignment/drift, secure scores, identity inventory, audit events, and assessment runs (read-only, plus one assessment-run action)

Claude plugins for IRONSCALES - AI-powered anti-phishing, incident triage, email classification, and crowdsourced threat intelligence

KnowBe4 - phishing simulation, security awareness training, user risk management

Liongard - environments, inspections, systems, detections, alerts, configuration monitoring

Microsoft 365 - users, mailboxes, Teams, OneDrive, licensing, and security posture

Meraki - Dashboard API network management, device monitoring, firewall & VPN, wireless

Claude plugins for Mimecast Email Security - message tracking, threat intelligence, queue management, and email security operations

Proofpoint Email Protection - TAP, quarantine, threat intel, forensics, URL defense, VAP reports

RocketCyber managed SOC - incidents, agents, events, threat detection

runZero - asset discovery, network scanning, inventory management

SaaS Alerts - SaaS security monitoring and alerting for M365 / Google Workspace: alerts, events, anomaly detection, multi-tenant response

SentinelOne XDR - threat detection, incident response, and endpoint agent management via the Purple AI MCP server

SpamTitan by TitanHQ - quarantine queue management, email flow stats, sender allowlist/blocklist for MSPs

ThreatLocker - zero-trust application allowlisting, approval triage, audit log investigation, computer inventory

DevExpress XAF (eXpressApp Framework) skills: business model, business logic, controllers, views, editors, filtering, appearance, validation, security, reports, and performance for EF Core and XPO.

DSPy-powered AI safety monitor for detecting backdoors and malicious behavior in code with 90% detection rate

Circuit breakers, kill switches, approval guards, and safety mechanisms for production systems

52 security skills covering OWASP Web Top 10:2025, LLM Top 10:2025, API Security Top 10:2023, and systems-software bug classes (memory-API misuse, crypto-library wiring, privilege handling, concurrency, numeric trust-boundary), plus three review modes (PR gate, full scan, contract review). Auto-invokes on vulnerable code and rewrites it inline.

A comprehensive skill for Tencent Cloud EdgeOne (Edge Security & Acceleration Platform), covering edge acceleration (DNS, certificates, caching, rule engine, L4 proxy, load balancing), edge security (DDoS protection, Web protection, Bot management), edge media (real-time video / image processing), edge development (Edge Functions, EdgeOne Pages), and more.

Displays risk level and recovery info before every Bash command execution

Descope authentication skills: integration, Auth0/Okta/WorkOS/Stytch migration, Terraform, FGA authorization schemas, security review, and BYOS custom UI

Azure API Management operations - API inventory, policy drift detection, key rotation workflows, and contract diff checks across revisions.

Azure Backup and Site Recovery operations - job health checks, restore drill readiness, recovery plan audits, and cross-region resilience checks.

Azure Key Vault — secrets, keys, and certificates management with RBAC, rotation policies, and managed identity integration

Azure Kubernetes Service operations - cluster inventory, pod failure diagnostics, node pool scaling, and policy posture checks.