basitalisandhu/agent-security-skills
Claude Code security plugin and agentskills.io skill pack for securing LLM agents: threat modelling, config audits, prompt injection review, MCP server review, incident lookup, security evals, Semgrep rules, guard hooks and an incident-data
ARCHETYPE
Pragmatist
A balanced, no-drama setup: some rules, some tools, nothing extreme.
Copy this rig
$ git clone --depth 1 https://github.com/basitalisandhu/agent-security-skills MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/agent-config-audit .claude/skills/agent-config-audit $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/agent-eval-harness .claude/skills/agent-eval-harness $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/agent-session-log-review .claude/skills/agent-session-log-review $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/agent-threat-model .claude/skills/agent-threat-model $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/incident-lookup .claude/skills/incident-lookup $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/mcp-server-review .claude/skills/mcp-server-review $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/prompt-injection-review .claude/skills/prompt-injection-review $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/secure-agent-checklist .claude/skills/secure-agent-checklist $ npx degit basitalisandhu/agent-security-skills/plugins/agent-security/skills/semgrep-agentic .claude/skills/semgrep-agentic
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(**/.env)",
"Read(~/.ssh/**)",
"Bash(rm -rf *)",
"Read(**/*.pem)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(.env)",
"Bash(rm -rf /*)",
"Read(./.env.*)",
"Read(~/.aws/**)",
"Bash(git push --force*)",
"Bash(rm -rf:*)",
"Read(**/*.key)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(git rebase *)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(git commit *)",
"Bash(gh pr merge *)"
]
}
} MCP servers (1)
| server | source | est. tokens |
|---|---|---|
| agent-incidents env: AGENT_INCIDENTS_DATA | local / custom | 2.5k |
Skills (9)
Similar rigs
basitalisandhu/claude-skills
Claude Code skills, every skill I maintain in one repository: 87 skills in 13 plugins for AWS and Microsoft 365 security, agent security, compliance evidence, repository engineering, debugging, DevOps, docs and data, vendored from their sou
Skill Collector 10.1k tok ·
shipshitdev/skills
Claude, Cursor, Codex skills and commands
Skill Collector 10.4k tok ·
anomalyco/opencode
The open source coding agent.
Pragmatist 4.2k tok ·
DietrichGebert/ponytail
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
Pragmatist 1.6k tok ·