By cloudyrion
Comprehensive security assessment suite for Claude Code — code review, threat modeling, API security, compliance mapping, SBOM generation, and more. Includes quick-scan for developers and full audit suite for security professionals.
Review APIs for security vulnerabilities against the OWASP API Security Top 10 (2023). Accepts OpenAPI/Swagger specs, API code, or both. Analyzes authentication, authorization, data exposure, rate limiting, input validation, and business logic flaws. Generates a formal API Security Report with per-endpoint findings and remediation guidance. Use this skill whenever the user asks to review an API for security, audit an OpenAPI spec, check REST/GraphQL endpoints for vulnerabilities, assess API auth patterns, or validate API design against security best practices. Also trigger on: 'API security', 'OWASP API Top 10', 'OpenAPI review', 'Swagger audit', 'endpoint security', 'API pentest review', 'REST security', 'GraphQL security', 'is my API secure', or any request to find security issues in API definitions or implementations.
Review system architecture documents (HLD, LLD, design specs, diagrams) against security best practices, Secure by Design principles, and regulatory requirements. Identifies architectural anti-patterns, missing security controls, and design-level risks. Produces a formal Security Architecture Review Report with findings, framework traceability, and prescriptive recommendations. Use this skill whenever the user asks to review an architecture for security, assess a system design, evaluate a high-level or low-level design document, check if an architecture follows security best practices, or perform a Secure by Design review. Also trigger on: 'architecture review', 'design review', 'HLD review', 'LLD review', 'Secure by Design', 'security assessment of architecture', 'zero trust review', 'is this architecture secure', 'review my design', or any request to evaluate whether a system's structure and design decisions are secure — even informal phrasing like 'does this design look safe' or 'what security concerns do you see in this architecture'.
Design structured penetration test attack playbooks from architecture documents, code, threat models, or system descriptions. Produces an Attack Scenario Playbook with attack trees, step-by-step exploitation plans with tool commands, MITRE ATT&CK mapping, OWASP WSTG coverage, risk ratings, detection indicators, and mitigation recommendations. Use this skill when the user asks to create pentest scenarios, design attack playbooks, plan red team exercises, identify attack paths, build attack trees, or define penetration test cases. Also trigger on: 'pentest', 'attack scenario', 'attack playbook', 'red team', 'attack path', 'exploitation plan', 'penetration test', 'attack tree', 'offensive security assessment', or any request to systematically design attacks against a system.
Perform a full security code review with SAST scanning, taint analysis, CWE mapping, OWASP Top 10 coverage, and generation of a formal Security Code Review Report. Use this skill whenever the user asks to review code for security vulnerabilities, audit a codebase or file for security issues, prepare a security assessment before merging, run a SAST scan, check for injection flaws, hardcoded secrets, broken auth, or crypto weaknesses. Also trigger when the user mentions 'security review', 'vulnerability scan', 'code audit', 'pen test the code', 'OWASP check', 'CWE mapping', or wants to generate a security findings report — even if they don't use the exact phrase 'security code review'.
Map security controls, findings, or risk registers across regulatory frameworks to produce a compliance cross-reference matrix. Supports NIS2, DORA, EU CRA, ISO 27001:2022, SOC 2, GDPR, BSI IT-Grundschutz, NIST CSF 2.0, and OWASP ASVS. Identifies compliance gaps where framework requirements have no corresponding control. Use this skill whenever the user asks to map controls to frameworks, check compliance coverage, create a compliance matrix, perform a gap analysis against NIS2/DORA/CRA/ISO 27001, cross-reference security controls, or prepare for an audit. Also trigger on: 'compliance mapping', 'regulatory mapping', 'framework mapping', 'NIS2 compliance', 'DORA compliance', 'CRA compliance', 'ISO 27001 gap analysis', 'SOC 2 mapping', 'audit readiness', 'control mapping', 'compliance gap', or any request to assess how security controls align with regulatory requirements — even 'are we NIS2 compliant' or 'what do we need for DORA'.
Executes bash commands
Hook triggers when Bash tool is used
Modifies files
Hook triggers on file write and edit operations
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Enterprise-grade security assessments, threat modeling, and compliance mapping — directly inside Claude Code.
A Claude Code plugin that turns Claude into a security engineer. Run full SAST code reviews, generate STRIDE threat models, map compliance gaps against NIS2/DORA/ISO 27001, produce audit-ready risk registers, and auto-patch vulnerabilities — all from your terminal.
Built for two audiences:
# Add the CLOUDYRION marketplace
/plugin marketplace add cloudyrion/cloudyrion-security-marketplace
# Install the security plugin
/plugin install cloudyrion-security@cloudyrion-marketplace
That's it. All 12 skills are now available.
| Command | What it does |
|---|---|
/cloudyrion-security:quick-scan | OWASP Top 10 check + secret detection + dependency CVE scan. Under a minute. |
/cloudyrion-security:code-review | Full SAST with taint analysis, CWE mapping, and formal report |
/cloudyrion-security:api-security | OWASP API Security Top 10 assessment against your endpoints |
/cloudyrion-security:sbom | CycloneDX/SPDX Software Bill of Materials with vulnerability enrichment |
/cloudyrion-security:iac-scanner | Security checks for Terraform, Kubernetes, Docker, CloudFormation, Helm |
/cloudyrion-security:vibe-patch | Reads your code review report and generates minimal fix patches automatically |
| Command | What it does |
|---|---|
/cloudyrion-security:suite | Runs all applicable skills in dependency order, produces a unified dashboard |
/cloudyrion-security:threat-model | STRIDE/PASTA threat modeling with data flow diagrams and MITRE ATT&CK mapping |
/cloudyrion-security:architecture-review | Secure by Design review against architecture documents |
/cloudyrion-security:compliance-mapper | Gap analysis across NIS2, DORA, EU CRA, ISO 27001, GDPR, SOC 2, NIST CSF |
/cloudyrion-security:risk-register | Audit-ready Excel risk register with MITRE ATT&CK and framework traceability |
/cloudyrion-security:attack-scenarios | Pentest attack playbooks with exploitation steps and detection indicators |
Run /cloudyrion-security:suite for a complete security assessment. It orchestrates all skills in the right order:
Phase 0 Quick Scan (optional) — fast triage
Phase 1 Code Review, API, IaC, SBOM — independent scans
Phase 2 Architecture + Threat Model — consumes Phase 1 findings
Phase 3 Compliance + Risk Register — aggregates everything
Phase 4 Vibe Patch (if findings exist) — auto-remediation
=> Unified Dashboard — single report with cross-references
Three automated checks ship with the plugin (active by default):
| Trigger | What happens |
|---|---|
| You write or edit a file | Scans for hardcoded secrets (API keys, tokens, passwords) |
| You modify a dependency file | Reminds you to run an SBOM vulnerability check |
You create a PR with gh | Reminds you to run a quick-scan before merging |
To disable a hook, remove its entry from hooks/hooks.json in the plugin directory.
|
Application Security
|
Threat Intelligence
|
Compliance & Governance
|
Infrastructure
|
Running /cloudyrion-security:suite on a Flask web application produced:
npx claudepluginhub cloudyrion/cloudyrion-security-marketplace --plugin cloudyrion-securityAgentic-Security is a powerful Claude Code plugin that automatically performs Application Security Testing (SAST, SCA, secrets detection, and more). Think of it as the easy button for making your Claude-generated code safe and secure.
AI-powered cybersecurity code review with 8 specialist agents, OWASP Top 10:2021, CWE Top 25:2024, MITRE ATT&CK v15, and framework-aware false-positive suppression
Check OWASP Top 10 compliance
Security skills for vibe coding — pre-coding security assessment, code vulnerability review, and threat modeling. Works without any MCP server or Jira/Confluence setup.
Security scanning, dependency CVE audits, and exposure-aware risk prioritization.
Open-source cybersecurity analysis agent. Scans any local project for vulnerabilities: code security (SAST), dependency CVEs (SCA), secret leaks, authentication/authorization flaws, cryptographic weaknesses, misconfigurations, supply chain risks, and CI/CD security. Covers all OWASP 2025 Top 10 and CWE Top 25 categories. Generates prioritized reports with remediation guidance. Invoke with /cyber-neo [path].