Help us improve
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
By subagentceo
Operator-side IT admin plugin for GitHub-tier operations: claude-code OAuth rotation, repo→org secret promotion, secrets parity audit, branch-protection ruleset CRUD, and a security-aware linter for Claude Code Action workflows (.github/workflows/claude*.yml). Dogfoods OSEC1/OSEC2/OSEC3 (secret model), OIT1 (minter pattern), and OAUTO13 (workflow security baseline) into a single plugin that exercises the full claude-code plugin spec: skills + hooks + monitors + agents + MCP server.
npx claudepluginhub subagentceo/knowledge-engineering --plugin github-it-adminBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Full CRUD over the GitHub branch protection ruleset (gh api repos/.../rulesets/<id>). Use when adding/removing required status checks, adjusting strict_required_status_checks_policy, or modifying any other ruleset parameter. The chassis ruleset id is 16440994 (from setup-branch-protection.ts).
Lints .github/workflows/claude*.yml files for the OAUTO13 security baseline derived from https://github.com/anthropics/claude-code-action/blob/main/docs/security.md. Use whenever editing claude.yml or claude-code-review.yml; this skill catches anti-patterns (wildcard allowed_bots, pull_request_target with write perms, missing @v1 pin, ANTHROPIC_API_KEY presence, etc.) at edit time instead of CI time. Also exposed as MCP tool lint_claude_action_workflow.
Re-mint CLAUDE_CODE_OAUTH_TOKEN via `claude setup-token` and dual-write to gh org + repo. Use when rotating the Claude Code OAuth token (quarterly per docs/operator-runbooks/secret-rotation.md, immediately on compromise, or when switching the active identity between admin-jadecli and alex-jadecli). Wraps the manual flow used 2026-05-18 into a reusable scaffold.
Run the OSEC1 parity verifier (npm run verify:secrets) plus a drift report by secret age. Use to confirm gh-org/repo/local plane parity and identify secrets stale enough to warrant rotation under the OSEC2 quarterly policy.
Promote a repo-scoped GitHub secret to org scope (visibility=selected). Use when a secret currently exists at gh-repo scope but is needed at gh-org for the OSEC1 parity table. Operator-paste required because the gh API is write-only on secret values.
This plugin requires configuration values that are prompted when the plugin is enabled. Sensitive values are stored in your system keychain.
gh_orgOrg for secret promotion + branch-protection ops. Defaults to subagentceo for this chassis.
${user_config.gh_org}gh_repoRepo name (without owner). Defaults to knowledge-engineering for this chassis.
${user_config.gh_repo}secret_max_age_daysSecrets older than this trigger a drift notification from the secret-age-watch monitor.
${user_config.secret_max_age_days}Harness-native ECC operator layer - 61 agents, 246 skills, 76 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
Upstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques
Per-merged-PR audit follow-up generator. Reads the session transcript at ~/.claude/projects/<dir>/<session-id>.jsonl, computes tool-call waste/latency/throughput stats for the work that landed a given PR, and emits a templated follow-up PR body plus the top 3 highest-impact findings as issue bodies. Dogfoods OAUDIT family: build-use-iterate-improve the merge process itself by surfacing where the agent wasted calls.
Code-intelligence + document tooling for mirroring HTML/PDF documentation (e.g. anthropic.com/sitemap.xml pages): HTML, TypeScript, and JavaScript language servers (VS Code's extracted servers + typescript-language-server) plus the official Model Context Protocol PDF server. Binaries are pinned as repo devDependencies and invoked via npx.
Personalized platform-engineering plugin for the operator: AlloyDB Omni install, Docker MCP profile wiring, Voyage+Turbopuffer+AlloyDB embeddings architecture, and citation/test/outcome discipline. Modeled after subagentceo/knowledge-work-plugins/cowork-plugin-management.
Operator-side IT admin plugin: scriptable CRUD over vendor API tokens for Cloudflare, Turbopuffer, Neon, Parallel.ai, and Nimbleway. Implements the OSEC3 long-lived-minter pattern with macOS keychain bootstrap. Replaces browser-click token mint flows with deterministic CLI flows that never leak secret values into agent context.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimAdmin access level
Server config contains admin-level keywords
Modifies files
Hook triggers on file write and edit operations
Uses power tools
Uses Bash, Write, or Edit tools
Share bugs, ideas, or general feedback.
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security
Reliable automation, in-depth debugging, and performance analysis in Chrome using Chrome DevTools and Puppeteer