Every spell in this class, in the row where it usually goes. Pick a few from each row for a loadout.
ScoutGather context
CraftMake the thing
TestCheck the work
Addy Osmani Security and HardeningScroll
Anthropic Claude Security PluginRelic
OpenAI Codex SecurityRelic
Trail of Bits fp-checkRelic
Trail of Bits Insecure DefaultsRelic
Trail of Bits Property-Based TestingRelic
Trail of Bits Sharp EdgesRelic
Trail of Bits Variant AnalysisRelic
Trail of Bits SkillsRelic
SonarQube Agent PluginRelic
StackHawk Agent SkillsRelic
Endor Labs Agent KitRelicShipDeliver it
Nothing equipped here
Quest Find and fix exploitable holes in a web app you own before it ships
Claude Opus 5.5
Anthropic Security Guidance Plugin
Semgrep GuardianAnthropic Claude Security PluginStackHawk Agent Skills16 spells
Checks input handling, auth, sessions, dependencies, and privacy rules before accepting untrusted data.
109,146 GitHub stars on addyosmani/agent-skills
Claude Code plugin that scans your repo or a diff with a team of agents, verifies each finding, and drafts patch files.
43,650 GitHub stars on anthropics/claude-plugins-official
Claude Code hooks that flag risky code on edit, review each turn's diff, and review commits for multi-file flaws.
43,650 GitHub stars on anthropics/claude-plugins-official
Codex plugin and CLI that scan a repo or diff for vulnerabilities, validate findings, and draft and verify fixes.
11,163 GitHub stars on openai/codex-security120,652 npm downloads last week for @openai/codex-security
Skill and workflow that map a codebase function by function before an audit, recording what each assumes, promises and depends on.
7,705 GitHub stars on trailofbits/skills
Skill that checks suspected security bugs one at a time and returns a true or false positive verdict with evidence after six gate reviews.
7,705 GitHub stars on trailofbits/skills
Claude Code plugin that audits a repo, folder or file for fallback secrets, default credentials, fail-open switches and other insecure defaults.
7,705 GitHub stars on trailofbits/skills
Skill that writes, reviews and triages property-based tests with Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity.
7,705 GitHub stars on trailofbits/skills
Skill and agent that find error-prone APIs, dangerous configuration options and footgun designs that make security mistakes easy.
7,705 GitHub stars on trailofbits/skills
Skill and workflow that take one known bug, extract its root cause and hunt the other places it occurs, with CodeQL and Semgrep templates.
7,705 GitHub stars on trailofbits/skills
Trail of Bits marketplace of security plugins for code audits, Semgrep and CodeQL, smart contracts and variant analysis.
7,691 GitHub stars on trailofbits/skills
Connects the agent to SonarQube CLI and MCP Server for issues, quality gates, coverage, secrets scanning and dependency risks.
113 GitHub stars on SonarSource/sonarqube-agent-plugins
Plugin that scans each file the agent writes with Semgrep Code, Supply Chain and Secrets, and sends findings back to fix.
18 GitHub stars on semgrep/guardian
Skills that configure and run HawkScan DAST against your running app, turn findings into fix tasks, and rescan.
16 GitHub stars on stackhawk/agent-skills
Subagents that read Endor Labs findings to triage AI SAST results, plan dependency fixes and explain vulnerabilities.
10 GitHub stars on endorlabs/ai-plugins
Snyk MCP server and hooks that scan agent code, dependencies, containers and IaC, and rescan after each fix.
