Browse plugins

Hookify creates custom hooks to prevent unwanted behaviors by analyzing conversation patterns or explicit instructions, using simple markdown configuration files with regex pattern matching. It supports four hook events (PreToolUse, PostToolUse, UserPromptSubmit, Stop) and provides commands to generate rules, list configurations, and interactively manage hook behavior without requiring restarts.

This skill audits any project for security vulnerabilities (OWASP Top 10, CWE Top 25, CVSS scoring) and GitHub repositories, with deep PHP/TYPO3 scanning across 80+ checkpoints and 19 reference guides. It hooks into PreToolUse events to warn about risky commands before execution.

This plugin automatically loads credentials from a CLAUDE_ENV_FILE environment variable on session start and redacts secrets from CLI output in real-time using the nopeek CLI tool. It intercepts both session initialization and tool execution to prevent sensitive data from being exposed in logs or terminal output.

This skill prevents dangerous GitHub release commands (like unsigned tags and bypassed CI) by intercepting them via hooks, then orchestrates safe releases with version bumps, signed tags, and CI-driven workflows across multiple ecosystems (TYPO3, PHP, Node.js, Go, Python, Rust). It auto-detects project type, manages versioning from conventional commits, and ensures supply chain security through signed tags and attestations.

Reins intercepts tool calls via pre/post hooks to block destructive actions, route high-risk operations to human approval, and maintain an immutable audit trail of all decisions. It protects against vulnerabilities covered in OWASP MCP, ASI, and Agentic Skills Top 10 threat models by analyzing commands before execution and logging outcomes to a local decision log.

brooks-lint performs AI-powered code reviews grounded in twelve classic engineering books, diagnosing code against six decay risk dimensions with book citations and severity labels. It offers six analysis modes (PR review, architecture audit, tech debt, test quality, health dashboard, and auto-fix) that produce structured findings with symptoms, sources, consequences, and remedies.

Safety Net intercepts and blocks destructive git and filesystem commands before AI agents execute them by analyzing command semantics, making it immune to flag reordering and shell wrappers. It runs as a PreToolUse hook across seven coding agent CLIs (Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi) and works on Windows, macOS, and Linux.

This plugin provides Git workflow automation including worktree management, branch cleanup, secret scanning, and configuration validation through hooks and guardrails. It uses a PreToolUse hook to inspect and control tool execution decisions, with built-in shell integration for Git operations.

This plugin documents AI-generated codebases and audits them for security/performance gaps by comparing documented intent against actual implementation, producing a reviewer-ready shipping packet. It provides five commands to reverse-engineer architecture, map test coverage, and identify risks that generic scanners miss.

This Agent Skill assesses software projects against enterprise-grade security and quality standards including OpenSSF Scorecard, Best Practices Badge, SLSA, and supply chain security frameworks. It provides dynamic scoring across different platforms and languages, with automation scripts and templates to help projects progress toward compliance certifications.

Provides best-practice guidance for Dockerfile development, Docker Compose orchestration, and multi-platform builds with Docker Bake, including CI testing patterns and security hardening. Includes a companion skill for Windows hosts running Docker Desktop via WSL2 to prevent bind-mount path corruption.

This skill validates deployable TYPO3 v14 site/project repositories against a gold-standard ruleset covering layout, Docker/Compose topology, Concourse CI pipelines, supply-chain gating, secrets, and Valkey/ofelia runtime. It includes a self-contained Python checker and machine-readable rule catalogue requiring only pyyaml, no external services.