Help us improve
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
By sethdford
Secure coding, OWASP guidance, input validation, cryptography, authentication, and secrets management for secure application development.
npx claudepluginhub sethdford/claude-skills --plugin security-secure-developmentAudit authentication and authorization implementation for compliance with secure design principles.
Check application against OWASP Top 10 and identify gaps in critical security controls.
Conduct a comprehensive security code review examining OWASP Top 10, secure coding patterns, input validation, and cryptography.
Design secure authentication systems with strong password policies, MFA, secure password reset, and session management.
Design authorization systems (access control, role-based permissions, principle of least privilege) to enforce fine-grained access policies.
Select appropriate cryptographic algorithms and parameters for encryption, hashing, key derivation, and digital signatures.
Design and implement input validation patterns (whitelisting, boundary checks, type validation) to prevent injection and buffer overflow attacks.
Implement context-specific output encoding to prevent XSS and injection attacks. Encode HTML, URL, JavaScript, and other contexts appropriately.
Share bugs, ideas, or general feedback.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Security best practices advisor with vulnerability detection and fixes
Agents specialized in security engineering and threat mitigation. Focuses on secure architecture, vulnerability assessment, and compliance.
Security guidance skills for AI coding assistants. Covers cryptography, web security, supply chain, MCP servers, Kubernetes, API gateways, fuzzing, static analysis, audit workflows, and more.
Cross-cutting security utilities including security champion programs, awareness training, secure architecture review, bug bounty, metrics, red team exercises, and documentation.
Comprehensive security plugin: OWASP Top 10, authentication patterns, cryptography, API security, secrets management, supply chain security, DevSecOps, container security, zero trust, and threat modeling.
Security code review skill based on Project CodeGuard's comprehensive security rules. Helps AI coding agents write secure code and prevent common vulnerabilities.
Establish architecture governance, design fitness functions, manage tech debt, and ensure compliance. Build sustainable architecture practices.
QA skills for accessibility-testing domain.
QA skills for api-testing domain.
Master architecture communication: C4 models, RFCs, presentations, and documentation. Align stakeholders and explain architectural decisions.
Product vision, strategy, positioning, and go-to-market planning.
Comprehensive, standards-grounded Claude Code skills for every role in the Product Development Lifecycle.
454 skills and 173 commands across 57 plugins for 8 roles.
| Role | Skills | Commands | Plugins | Standards Alignment |
|---|---|---|---|---|
| architect | 63 | 10 | 8 | TOGAF, IASA BTABoK, ISO 42010, SWEBOK v4 |
| engineer | 65 | 26 | 8 | SWEBOK v4, SFIA v9, DORA, SPACE, ISO 25010 |
| product-manager | 65 | 26 | 8 | AIPMM PmBoK, ISPMA SPMBoK, PDMA NPDP |
| tech-lead | 63 | 25 | 8 | SFIA v9, DORA/Accelerate, Team Topologies |
| security | 64 | 25 | 8 | NIST CSF 2.0, OWASP SAMM, MITRE ATT&CK, ISO 27001 |
| designer | 63 | 27 | 8 | WCAG 2.2, ISO 9241, Nielsen Heuristics |
| qa-engineer | 63 | 26 | 8 | ISTQB, ISO 25010, WCAG 2.2, IEEE 829 |
| sdlc | 8 | 8 | 1 | ISO/IEC 12207, ISO/IEC 15288 |
Every skill is built on three principles:
claude install github:sethdford/claude-skills/engineer
claude install github:sethdford/claude-skills/engineer/testing
claude install github:sethdford/claude-skills
| Plugin | Skills | Commands | Focus |
|---|---|---|---|
| system-design | 10 | 4 | Decomposition, DDD, microservices, event-driven, CQRS |
| quality-attributes | 8 | 3 | Scalability, reliability, performance, trade-off analysis |
| decision-making | 8 | 3 | ADRs, technology radar, build-vs-buy, migration strategy |
| data-architecture | 8 | 3 | Data modeling, storage selection, event sourcing, pipelines |
| infrastructure-design | 8 | 3 | Cloud architecture, deployment, DR, multi-region |
| architecture-governance | 7 | 3 | Principles, fitness functions, tech debt, compliance |
| communication | 7 | 3 | C4 diagrams, RFCs, stakeholder presentations, roadmaps |
| architect-toolkit | 7 | 3 | Katas, reviews, mentoring, anti-patterns catalog |
| Plugin | Skills | Commands | Focus |
|---|---|---|---|
| code-quality | 10 | 4 | Clean code, refactoring, SOLID, code smells |
| testing | 9 | 4 | TDD, property-based testing, test architecture |
| debugging | 8 | 3 | Systematic debugging, root cause analysis, postmortems |
| implementation-patterns | 8 | 3 | Design patterns, data structures, concurrency |
| api-development | 8 | 3 | REST, GraphQL, gRPC, API design and testing |
| devops-practices | 8 | 3 | CI/CD, containers, deployment, monitoring |
| database-engineering | 7 | 3 | Schema design, query optimization, migrations |
| engineer-toolkit | 7 | 3 | Technical writing, git workflow, incident response |