Repository Index

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

• agent-security
• agent-skills
• agentic-ai
• ai-security

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

Protect against malicious open source packages 🤖

• devsecops
• security
• supply-chain-security
• policy-as-code

Docker Scout CLI

• docker
• security
• supply-chain-security

Supply Chain Security Research - Living Off The Pipeline tools

• lotp
• supply-chain-security
• living-off-the-pipeline

Security training for the apps you actually ship. Open your browser and start hacking.

• appsec
• ctf
• cybersecurity
• nextjs

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

• ansible
• ansible-playbook
• devsecops
• infrastructure-as-code

Encrypted .env files with TOTP unsealing for production deploys. Cross-stack (Node + Java). Zero deps. Defends against npm supply-chain attacks.

• 2fa
• aes-gcm
• dotenv
• encryption