#security

实战 SRC / 众测 / Bug bounty 漏洞挖掘 Claude Code skill — 19 个攻击类 playbook、305 个结构化 payload、263 个 WAF/EDR 绕过、2887 份 HackerOne 真实案例、88,636 WooYun 案例统计

Senior-developer discipline for AI coding agents. A commit gate that counts unchecked as failing, quality controllers that refuse to call unfinished work done, and a lessons loop that closes each escaped bug's class. One Go binary, no runtime deps, works with 20+ agents.

Auto mode for every coding agent, built on Jev: risk-scores every tool call with session context (deny / ask / allow), flags prompt injection in results, checks skills and plugins. Claude Code, Codex, Copilot, Gemini, Cursor, pi, OpenCode, ACP.

Claude and ChatGPT now log into your app as your customers. OneHuman decides what they can see and do. Join our community: https://discord.gg/9QX9jTwBq

Reachability triage for vulnerability scans. Feeds scanner findings to an LLM agent that reads your source and decides which CVEs are actually reachable.

🕶️ Secrets your AI agent can USE but never SEE — Claude Code skill + zero-dependency macOS Keychain CLI. Env injection, pointer manifest, prompt-injection tripwire.

SECS (SECurity aSsistant) turns an AI coding agent (Claude Code, Cursor, Codex) into an authorized information-security assistant - 35 security Agent Skills, a Debian/Ubuntu/Kali toolchain installer, and a local Metasploitable 3 practice lab, under strict rules of engagement.

Prueba de seguridad, con Claude Code, a esa app que hiciste con IA. 20 fallas comunes, scanners gratis, prompts y blindaje.

Runtime permission firewall for AI agents - YAML policies, one-tap approvals (macOS popup/Telegram), tamper-evident signed audit log. Benchmarked: 103/103 attacks blocked, 8/8 normal dev ops allowed.

Open-source server that refuses vulnerable package installs. The backend the refuse CLI shim calls.

Security scanner for Claude Code skills, plugins, and MCP servers. A verdict before you install.

chennai (chen N ai) is a hybrid AI agent and a terminal user interface for static analysis, data-flow tracing, and AI-assisted code and security analysis.

Credential proxy for the AI era — agents use credentials without seeing them

Offline repo inspection and change review for AI coding agents. Scan instructions, compare saved scans, explain findings, and export local reports.

Development-time local workspace security alignment for AI coding agents

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

One-click sandboxes for AI agents, with egress policy, MCPs, skills and audit. Built on NVIDIA OpenShell.

Master AI Skills Collection 2026 - Scalable Agent Scripts & Automation Hub

A reverse engineering and CTF agent for the terminal: planner/executor/researcher routing, 24 local tools, workflow modes, and live turn visibility.

Ten composable AI skills covering the full arc from idea to launch. Discovery hub for prd-ready, architecture-ready, roadmap-ready, stack-ready, repo-ready, production-ready, deploy-ready, observe-ready, launch-ready, harden-ready. Plug into Claude Code, Codex, Cursor, Windsurf.

Self-hosted HomeLab operations layer for monitoring, backup, recovery, automation, and future local AI agents.

🔒 Кросс-платформенный локальный мост для AI coding agents: Windows, macOS и Linux. Работа с Git-репозиторием через API, автопилот, безопасный commit без git push.

A Linux VM for your coding agent. Your repos and your notes inside, your keys nowhere near it. One Go binary, no daemon, and a backend that cannot push.

DeepSeek Harness 自动审批插件：在 workspace-write 沙箱之上叠加确定性规则 + LLM 安全审批，自动模式不放宽沙箱、fail-closed。 Safe auto-approval for DeepSeek Harness — deterministic rules + LLM review on top of the workspace-write sandbox. Auto mode without ever granting full-access.

Verifiable records of AI agent tool interactions. Forwards every byte, blocks nothing, hash-chains the log. Python 3.8+, zero dependencies, MIT.

Self-hosted pentest copilot. Substrate-first (technique catalog + playbooks + RAG + deterministic tools) with structural verifier rules and LLM-as-judge quality eval. Apache 2.0.

Permission-gated Codex skill for supervising persistent Claude Code workers.

Log in to Claude.ai without touching your inbox: magic links auto-open in the right browser via IMAP IDLE. Zero dependencies, multi-account, 6-layer security

Claude Code plugin: 5 agentes de revisión de código (seguridad, calidad, convenciones frontend, esquema BD, testing) + skill de arquitectura multi-tenant para SaaS, derivada de una auditoría real que encontró y corrigió 5 vulnerabilidades IDOR.

Save a secret: a small window opens that Claude cannot see, you paste there, it lands in 1Password. Read it back: any item in your vault loads into Claude with one fingerprint check, names only, never the values. Keys you paste in the chat are deleted before Claude reads them. Mac, Windows, Linux. MIT.

Offline, no-AI "safe to ship?" gate for vibe-coded apps — finds the security mistakes AI coding agents make (secrets, unprotected routes, eval-RCE, SQLi, CORS, JWT, leaked keys). CLI + MCP, agent-runnable.

AI governance and edge infrastructure platform with HTTP/3, OpenTelemetry tracing, adaptive load shedding, circuit breakers and Kubernetes deployment support.

Local-first AgentOps control plane prototype for safe AI-to-agent command validation, policy evaluation, and redacted audit logging.

Zero-execution preflight scanner for untrusted AI-agent and MCP artifacts

AI Guardian Firewall — a local, user-space, agent-agnostic firewall that mediates an autonomous AI agent's actions (files, shell, network, services) with a deterministic policy boundary, a tamper-evident audit log, and a human-in-the-loop approval cockpit. No kernel modules. Apache-2.0.

seatbelt for my pi.dev agent: blocks secret-file access, redacts creds from output, blocks egress + git leaks.

Production-grade low-level engineering skills for AI coding agents: 193 verified, source-backed skills (C/C++/Rust/asm/kernel/networking/embedded/Zig/GPU, safety, PQC, eBPF, io_uring, secure boot, RE, design) — VFS fops, writeback, workqueues, timers, kthreads, sk_buff, TCP CC. Every claim traced: claim -> source -> section -> skill.

Detect and remove invisible-Unicode text watermarks + AI-writing stylistic tells. 100% deterministic removal, installable agent skill included.

PACT is a runtime security layer for AI agents.

A living spec defending against the 26 categories of mistakes LLMs systematically make in Rust. Claude Code skill + 3 slash commands (rust-audit, rust-fix, rust-plan) built on a single source of truth.