도구

Privacy compliance plugin: decides whether processing activities need a PIA or DPIA, generates privacy impact assessments, reviews DPAs from the controller or processor side, and drafts DSAR responses within statutory deadlines. Official from Anthropic.

Anthropic's official AI governance plugin: tiers AI use cases against your internal register, runs impact assessments across applicable laws such as the EU AI Act, reviews vendor AI terms for training-data and liability risk, and periodically checks for drift between AI policy and practice.

NetEase's open-source cross-platform UI automation framework: locates elements by image recognition to automate games and apps on Android, iOS and Windows without touching their code. airtest run executes cases and airtest report builds HTML reports.

High-accuracy retrieval-augmented Q&A over paper PDFs, text and Office documents, filling in citation metadata, checking retractions and attaching traceable sources to answers. Provides the pqa CLI and a Python library. Needs an LLM API key by default; local models can be configured.

Say build a harness for this project and it designs a domain-specific agent team, generating subagent definitions, companion skills and orchestration, validates them and keeps evolving them from feedback. Supports workflow orchestration, persistent agent teams and subagent delegation.

Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.

74 game development skills plus a router skill that detects which of 10 engines your project uses (Godot, Unity, Unreal, Phaser, three.js, Bevy and more) and loads the matching skills, along with art asset and store release workflows. Community-maintained.

Turns Peng Sida's public research-writing notes into a skill: revises abstracts, introductions, methods and experiments of ML/CV/NLP papers from a reviewer's view, checks that each claim has experimental evidence, and runs a pre-submission self-check. Pure methodology, no API key.

Offline speech toolkit for Apple Silicon Macs: CLI text-to-speech (including Chinese and voice cloning) and speech-to-text, for voicing lessons and explainer videos or transcribing lectures and interviews, with data staying local. Needs an M-series Mac and Python 3.10+; MP3 export needs ffmpeg.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

Trail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.

From Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

Query cloud resources and SaaS APIs live with SQL: plugins map AWS, Azure, GCP, GitHub, Kubernetes and other services to tables you can select from directly, no ETL needed. A single binary with Postgres built in.

Diffusion model inference in pure C/C++: one sd-cli command runs SD, FLUX, Qwen Image, Wan and more locally to create or edit images and short videos, with Metal acceleration on Mac. No cloud needed; bring your own model weights and use a release binary or build from source.

OpenAI's official browser-game skills: plan core gameplay and tech choices first, then build with Phaser for 2D or Three.js / React Three Fiber for 3D, plus HUD and menu UI, sprite animation, a GLB asset pipeline and in-browser playtesting.

Creates, edits and validates reproducible Python and SQL Jupyter notebooks: organizes cells as reports or tutorials, checks conclusions against actual output and reruns top to bottom before handoff. Maintained by OpenAI in the Data Analytics plugin of openai/plugins.

Build with OpenAI best practices inside Codex: call the OpenAI API, build and deploy agents with the Agents SDK, create ChatGPT apps and prepare submission materials, and create API keys directly. Maintained by OpenAI; Codex only.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.

Open-source LLM evaluation platform: one opencompass command picks the model and datasets and runs the evaluation across hundreds of benchmarks. Works with local Hugging Face models and API models, with vLLM and LMDeploy for faster inference.

Converts and two-way syncs Jupyter notebooks with plain Python scripts or Markdown, so agents can edit research and teaching notebooks like ordinary text and diffs stay readable. Needs a local Python environment; install with pip.