도구

Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.

A complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support.

Multi-host plugin marketplace with 90+ single-purpose plugins, 200+ subagents and 180+ skills covering language-specific development, ops, security, data and multi-agent orchestration. Installing a plugin loads only that plugin's content.

HR and compliance plugin with HR and legal advisor subagents plus employment contract and GDPR skills, for drafting hiring materials, onboarding, offboarding and performance policies, employment contracts, privacy policies, terms of service and DPAs. Mainly US and EU rules.

Security plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

HR plugin: drafts offer letters, generates onboarding checklists, runs performance reviews, answers policy questions, and produces compensation benchmarks and people analytics reports. Can connect to HRIS and ATS systems. Official from Anthropic.

Anthropic's official legal plugin marketplace: 13 plugins covering commercial contracts, privacy, product counsel, M&A, employment, regulatory, AI governance, litigation and IP, plus plugins for law school clinics and law students. All output is a draft for attorney review.

Anthropic's official employment law plugin: reviews hiring and termination risk by jurisdiction, classifies workers, tracks leave deadlines, manages internal investigations, and drafts policies with state supplements. Focused on US state law; output needs attorney review.

Anthropic's official AI governance plugin: tiers AI use cases against your internal register, runs impact assessments across applicable laws such as the EU AI Act, reviews vendor AI terms for training-data and liability risk, and periodically checks for drift between AI policy and practice.

Privacy compliance plugin: decides whether processing activities need a PIA or DPIA, generates privacy impact assessments, reviews DPAs from the controller or processor side, and drafts DSAR responses within statutory deadlines. Official from Anthropic.

Trail of Bits plugin for Culture Index assessments: profiles individual traits, checks team balance (gas, brake, glue), compares people with job profiles to flag burnout and attrition risk, and helps draft hiring profiles. Needs your own reports (JSON or PDF); PDFs need uv.

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

OpenAI's official Codex plugin for SharePoint: summarizes organization sites, pages and files, finds document owners and status, and plans updates to documents, spreadsheets or decks. Requires Codex with a ChatGPT sign-in and a work Microsoft 365 account.

The HR department of headcount's company-style agent org: 12 skills for org design, hiring, pay and levels, performance, employee relations, compliance, benefits and leave, on/offboarding, payroll, workforce planning and training. No account needed; have HR or a lawyer check compliance.

German-language HR plugin for German startups of about 100 people: employment contracts, DATEV payroll handoff, personnel files and data protection, AGG complaints, works councils, absences, benefits and dismissals under German labor law. German law only; have a lawyer or HR pro review.

Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+.

People-management skill pack for managers and HR with 7 skills: performance reviews, performance improvement plans (PIPs), 360-degree feedback surveys, interview scorecards, team health checks, team offsites and a 90-day plan for new managers. Text-only; no account or API key.

HR skills plugin: write inclusive job descriptions, build 30/60/90-day onboarding plans, design and analyze engagement surveys, and plan redundancy consultations (UK employment law by default) and organizational change. Text-only, no account; have legal or senior HR review redundancy plans.

Recruiting and sourcing skills: generate Boolean and X-ray search strings, plan sourcing strategy and draft candidate outreach, plus interview question banks, scorecards, reference-check scripts and offer letters, with an emphasis on structured, fair evaluation. Text-only; no account needed.

HR operations plugin bundling four skills: recruiting (job descriptions, interview scorecards, funnel analysis), HRBP (talent planning, performance, employee relations), people analytics (attrition prediction, pay equity) and ops, with helper Python tools. Scripts need Python 3.

DAIR.AI Academy lesson-planning plugin: from a topic or source material, builds an interactive mini-course of 6-8 lessons, each with goals, flashcards and a quiz, plus a final review, citing sources when you supply material. Output is local HTML; no server or account needed.

Job search plugin: import your resume and preferences, then it finds matching roles, tailors your resume to each, writes cover letters and can fill applications on Greenhouse, Lever and Workday. Needs the Claude in Chrome extension.