Tools

Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.

Lets agents model, lay out scenes, tweak materials and run Python in Blender, and import Poly Haven, Sketchfab and AI-generated 3D assets. Requires uv and the companion Blender add-on.

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

A complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support.

Generates or edits images: photos, illustrations, textures, game sprites, product mockups and transparent assets. A built-in Codex system skill using the image_gen tool, no install needed; with approval it can use a bundled CLI script that needs OPENAI_API_KEY. By OpenAI.

Collection of 2,400+ installable SKILL.md skills across development, security, cloud and ops, AI, marketing and more, with the AAS Core local MCP and an installer that help agents search, pick skills and preview install plans. Formerly antigravity-awesome-skills.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.

EU GDPR compliance skill covering lawful bases, consent management, access and deletion requests, data retention and breach notification, with checklists and sample code so legal and engineering can review privacy together. No account or API key; have a lawyer check conclusions.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Connects Claude Code to the clangd C/C++ language server for code intelligence, diagnostics and formatting. Install LLVM/clangd and add it to PATH first. Official Anthropic plugin.

Connects Claude Code to the C# language server csharp-ls for code intelligence and diagnostics. Needs .NET SDK 6.0+; install csharp-ls first via dotnet tool or Homebrew. Official Anthropic plugin.

All-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.

HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Fast vulnerability scanner driven by YAML templates: uses a community template library to detect known vulnerabilities over HTTP, DNS, TCP, SSL and more, supports custom templates and plugs into CI/CD. Use only on targets you're authorized to test.

Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks.

Compliance skill from Anthropic's official operations plugin: maps controls, owners and evidence for SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, schedules audits, runs gap analyses, and outputs audit-readiness checklists and evidence collection plans. Have legal or compliance experts review.

Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.

Project template that turns Claude Code into a game studio: 49 tiered subagents and 74 skills covering design docs, architecture, sprint planning, balance checks, QA and release, with Godot, Unity and Unreal engine specialists. Clone the repo to use it; Claude Code only.

CLI and library for evaluating and red-teaming LLM apps: compare prompts and model outputs in bulk, scan for security vulnerabilities and plug into CI/CD, with evals running locally. Now part of OpenAI and still open source under MIT.

Open-source reverse engineering framework and CLI: disassemble, debug, emulate and patch binaries across many architectures and file formats, scriptable through r2pipe or built-in JavaScript.

Encrypts secret values in YAML, JSON, ENV and INI config files using AWS, GCP or Azure KMS, age or PGP, so secrets can be safely committed to Git alongside code. A CNCF sandbox project.