Security engineer
Agent Plugins 1.0.0 compatible
Find and fix security risk early with threat models, dependency audits, secret scans, authorization review, and security review of diffs.
Version 1.0.2Updated Oct 20, 2026Source
First time? Install with npm i -g harnesstap
Download as Agent Plugins zipWhat's inside
Skills (5)
authz-reviewReview authorization across an application: who can perform which action on which resource, checked at every entry point, including tenant isolation, object-level checks (IDOR), and admin functions. Use when adding roles or permissions, before launching multi-tenant features, or after an access control bug.dependency-auditAudit third-party dependencies for known vulnerabilities, reachability, malicious or abandoned packages, and license risk, then produce a prioritized upgrade plan. Use for periodic supply chain reviews, when a CVE is announced, before adopting a new dependency, or when scanner alerts pile up.secret-scanFind secrets (API keys, tokens, passwords, private keys) in code, git history, CI logs, and container images, then rotate, remove, and prevent recurrence. Use when onboarding a repo, after a suspected leak, before open-sourcing code, or when setting up pre-commit and CI secret detection.security-diff-auditReview a code change specifically for security issues: injection, broken authorization, unsafe deserialization, SSRF, XSS, secrets, crypto misuse, and risky configuration, tracing untrusted input to sensitive sinks. Use on PRs touching auth, input handling, file or network access, crypto, or infrastructure. General code quality review belongs to staff-engineer.threat-modelingBuild a practical threat model for a system or feature: data flow diagram, trust boundaries, threats per element using STRIDE, ranked risks, and concrete mitigations with owners. Use when designing a new service or feature that handles sensitive data, authentication, payments, or external input, or before a security review.
Rules (3)
authz-checksCheck authorization on every request and every object.input-validationValidate and encode untrusted input at every boundary.no-secrets-in-codeNever commit or log secrets.
Commands (2)
scan-depsScan dependencies for vulnerabilities and summarize what to fix first.threat-modelStart a threat model for a system or feature and write the draft document.
Plugins (4)
security-guidance@claude-plugins-officialreverse-engineering@claude-code-workflowscode-review@claude-plugins-officialchrome-devtools-mcp@claude-plugins-official