By balsm-health
Balsm shared AI toolkit: skills, slash commands, and subagents used across every Balsm repo (API, Flutter app, website, OpenWA, docs).
Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
Uses power tools
Uses Bash, Write, or Edit tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Shared AI toolkit for all Balsm repos — skills, slash commands, and subagents in one place, installed once and visible from every project.
Packaged as a Claude Code plugin marketplace so a single install (user scope) surfaces everything in any repo on the machine.
Balsm-AI/
├── .claude-plugin/
│ └── marketplace.json # marketplace manifest (lists the plugin)
└── plugin/ # the plugin itself
├── .claude-plugin/
│ └── plugin.json # plugin manifest (name, version)
├── skills/ # 49 security skills + your own
├── commands/ # slash commands (e.g. /balsm-context)
└── agents/ # subagents (e.g. balsm-reviewer)
claude plugin marketplace add /Volumes/Dev/Balsm/Balsm-AI
claude plugin install balsm-ai@balsm-ai --scope user
After push to GitHub, others install with the repo slug instead of the path:
claude plugin marketplace add <org>/Balsm-AI
claude plugin install balsm-ai@balsm-ai --scope user
plugin/skills/<name>/SKILL.md with frontmatter (name, description).plugin/commands/<name>.md → invokes as /<name>. $ARGUMENTS available.plugin/agents/<name>.md with frontmatter (name, description, tools).Edit, commit, then claude plugin update balsm-ai (or restart) — changes flow to every project.
Every enabled skill/command/agent adds its description to context in all sessions. Keep plugin/skills/ curated; bump version in plugin/.claude-plugin/plugin.json on releases.
claude plugin disable balsm-ai # turn everything off
claude plugin enable balsm-ai # back on
claude plugin details balsm-ai # token-cost inventory
npx claudepluginhub balsm-health/balsm-ai --plugin balsm-aiUpstash Context7 MCP server for up-to-date documentation lookup. Pull version-specific documentation and code examples directly from source repositories into your LLM context.
AI-powered wiki generator for code repositories. Generates comprehensive, Mermaid-rich documentation with dark-mode VitePress sites, onboarding guides, deep research, and source citations. Inspired by OpenDeepWiki and deepwiki-open.
Claude + Obsidian knowledge companion. Sets up a persistent, compounding wiki vault (Karpathy's LLM Wiki pattern). v1.7 "Compound Vault" + v1.8 methodology modes close 5 of 5 priority gaps from the May 2026 compass artifact. Ships: substrate alignment with kepano/obsidian-skills, default Obsidian CLI transport, hybrid retrieval (contextual prefix + BM25 + cosine rerank per Anthropic's Sept 2024 research), per-file advisory locking for multi-writer safety, pre-commit verifier agent, AND methodology modes (LYT / PARA / Zettelkasten / Generic) for first-class organizational support no other Claude+Obsidian competitor offers. v1.7.x audit closure: every BLOCKER + HIGH + MEDIUM + LOW finding from the v1.7.0 audit is CLOSED or DEFERRED-with-rationale. Optional DragonScale Memory extension (log folds, deterministic addresses, semantic tiling lint, boundary-first autoresearch).
Complete AI coding workflow system. Self-correcting memory + persistent FTS5-indexed research wikis + auto-research loop + multi-LLM council on a single SQLite store. 33 skills, 8 agents, 22 commands, 37 hook scripts across 24 events. Cross-agent via SkillKit.
Make your AI agent code with your project's architecture, rules, and decisions.
Comprehensive C4 architecture documentation workflow with bottom-up code analysis, component synthesis, container mapping, and context diagram generation