Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

plugin-security-checker

Estrelas6

Forks0

Atualizado18 de junho de 2026 às 22:44

Use this skill to scan a Claude Code plugin (or any npm/PyPI package tree) for security issues before installation. Detects dangerous functions, code obfuscation, hardcoded credentials, schema problems, and known 2024-2026 supply-chain attack IOCs (Shai-Hulud, Nx s1ngularity, chalk/debug clipper, Axios RAT, litellm/.pth), mapped to MITRE ATT&CK/ATLAS, CVE, and OWASP.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

diegocconsolini

diegocconsolini/ClaudeSkillCollection

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

Explorador de arquivos

100 arquivos

SKILL.md

readonly

name	plugin-security-checker
description	Use this skill to scan a Claude Code plugin (or any npm/PyPI package tree) for security issues before installation. Detects dangerous functions, code obfuscation, hardcoded credentials, schema problems, and known 2024-2026 supply-chain attack IOCs (Shai-Hulud, Nx s1ngularity, chalk/debug clipper, Axios RAT, litellm/.pth), mapped to MITRE ATT&CK/ATLAS, CVE, and OWASP.
license	MIT

Plugin Security Checker Skill

Static security analysis for Claude Code plugins and package trees. This is a supporting tool for preliminary checks — it does not guarantee safety; always review source manually before installing untrusted plugins.

Usage

# Scan a single plugin (the documented entry point)
python3 scripts/scan_plugin.py /path/to/plugin

# JSON output
python3 scripts/scan_plugin.py /path/to/plugin --output scan.json --format json

# Generate a report from results
python3 scripts/generate_report.py scan.json --format markdown --output report.md

What it checks

Dangerous functions — Python (eval/exec/os.system/subprocess shell=True) and JavaScript (eval/Function/innerHTML), from the canonical references/dangerous_functions_expanded.json (63 Python + 18 JS patterns).
Obfuscation & credentials — base64/hex/char-code chains; hardcoded API keys/tokens.
Schema & permissions — plugin.json structure, hooks, MCP server config.
Supply-chain IOCs — named 2024-2026 npm/PyPI campaigns from references/supply_chain_iocs.json (verified against primary sources).

See agents/plugin-security-checker.md for the full workflow and the IntelligentOrchestrator (consensus-voting) entry points.

Mais deste repositório

mesmo repositório

batch-security-migration

diegocconsolini/ClaudeSkillCollection

Use when applying the same security fix across many files or repos at once — large-scale vulnerability remediation. Provides 7 copy-paste /batch recipes (XSS, HTTPS, SQLi, input validation, log PII, secret rotation, CVE patches) each with a safety tier and false-positive trap, plus scan_diff.py to prove the migration introduced no new HIGH/CRITICAL findings.

2026-06-266

security-hooks

diegocconsolini/ClaudeSkillCollection

Use this skill to install ready-made Claude Code hooks for security — a ConfigChange compliance audit trail (logs every settings/skill change), plus PreToolUse guards and optional HTTP notifications for security-relevant events. Covers command, http, and prompt hook types.

2026-06-186

security-memory-templates

diegocconsolini/ClaudeSkillCollection

Use this skill to seed Claude Code's auto-memory with pre-built security/compliance patterns — known-safe code patterns, false-positive suppressions for the plugin-security-checker, org compliance rules, and supply-chain best practices. Helps Claude apply consistent security judgment across sessions.

2026-06-186

chrome-devtools-optimizer

diegocconsolini/ClaudeSkillCollection

Use this skill to reduce token consumption by 70-80% when using the Chrome DevTools MCP. Applies a snapshot-first strategy (text over images) with decision trees and pattern guides for navigation, forms, debugging, and visual checks, plus optional Gemini Flash vision processing for the cases that genuinely need an image.

2026-06-186

claude-guide

diegocconsolini/ClaudeSkillCollection

Navigate Claude Code documentation and get quick answers about configuration, MCP, plugins, and best practices.

2026-06-186

docx-smart-extractor

diegocconsolini/ClaudeSkillCollection

Use this skill to extract and analyze large Word documents (1MB-50MB+) with minimal token usage. Losslessly extracts text, tables, formatting, and structure while achieving 10-50x token reduction through local extraction, semantic chunking by headings, and intelligent caching. Use when a .docx is too large for the context window (policies, contracts, technical reports).

2026-06-186

name	plugin-security-checker
description	Use this skill to scan a Claude Code plugin (or any npm/PyPI package tree) for security issues before installation. Detects dangerous functions, code obfuscation, hardcoded credentials, schema problems, and known 2024-2026 supply-chain attack IOCs (Shai-Hulud, Nx s1ngularity, chalk/debug clipper, Axios RAT, litellm/.pth), mapped to MITRE ATT&CK/ATLAS, CVE, and OWASP.
license	MIT

Plugin Security Checker Skill

Usage

# Scan a single plugin (the documented entry point)
python3 scripts/scan_plugin.py /path/to/plugin

# JSON output
python3 scripts/scan_plugin.py /path/to/plugin --output scan.json --format json

# Generate a report from results
python3 scripts/generate_report.py scan.json --format markdown --output report.md

What it checks

Dangerous functions — Python (eval/exec/os.system/subprocess shell=True) and JavaScript (eval/Function/innerHTML), from the canonical references/dangerous_functions_expanded.json (63 Python + 18 JS patterns).
Obfuscation & credentials — base64/hex/char-code chains; hardcoded API keys/tokens.
Schema & permissions — plugin.json structure, hooks, MCP server config.
Supply-chain IOCs — named 2024-2026 npm/PyPI campaigns from references/supply_chain_iocs.json (verified against primary sources).

See agents/plugin-security-checker.md for the full workflow and the IntelligentOrchestrator (consensus-voting) entry points.