Browse the directory

Slash command that reviews a pull request diff for security regressions: authentication and authorization gaps, injection surfaces, secret exposure, unsafe deserialization, and dependency risk introduced by the change.

A reusable agent prompt that vets a Claude Code plugin or marketplace before a team installs it. It walks source trust, the plugin's Will-install list and bundled components (skills, agents, hooks, MCP servers, commands), the context-window cost, version pinning, and the user/project/local/managed install scope.

Source-backed specialist agent for reviewing remote MCP authorization boundaries, protected resource metadata, resource indicators, token audience validation, token passthrough risk, and least-privilege scopes.

Source-backed agent that reviews the container isolation posture of a NanoClaw deployment, checking filesystem mounts, per-agent scoping, credential vault routing, messaging channel permissions, and scheduled tasks before agents run with real access.

Source-backed rules for deciding when an AI-assisted code review must escalate high-risk changes to security, infrastructure, data, release, or domain owners before merge.

Expert GitHub Actions security review capability pack applying documented workflow hardening, GITHUB_TOKEN least privilege, secrets handling, and fork PR safety checks from official GitHub Actions security documentation.

Checklist for reviewing remote MCP servers before team rollout: OAuth scopes, transport security, tool surface, registry provenance, and rollback.

Source-backed agent for security review of open-source pull requests, including untrusted fork boundaries, GitHub Actions permissions, secret and code scanning, dependency review, provenance signals, and maintainer-owned merge recommendations.