v1.1.0 — secure-coding & GenAI coverage expansion

Secure-coding & GenAI-security coverage expansion — 44 plugins · 105 skills · 15 agents.

New: secure-coding-lifecycle coverage

• Gitignore hygiene — infrastructure-security:secrets-management-review now checks sensitive paths (.env, keys, .claude/, tfstate, etc.) against .gitignore, plus the inverse (already-tracked) check.
• Reference packs — security-knowledge:asvs-reference (OWASP ASVS chapters/levels), MITRE DEF3ND added to framework-mapping, and secure-coding-kb (per-language safe-idiom / risky-library quick reference for Python/JS/Java/Go).
• Secure-by-design, before code exists — security-architect:prd-security-injection injects concrete security requirements into a PRD/feature-prompt/AI-agent plan before implementation; secure-architecture-maturity adds ASVS-level + OWASP SAMM program-maturity scoring.
• threat-modeling:maestro — CSA's layered threat-modeling framework for multi-agent/agentic systems, alongside STRIDE/PASTA.

New: GenAI/agentic security depth

• agentic-ai-security:mcp-security-review — MCP server trust, tool/resource poisoning, confused-deputy risk, consent/scope UX.
• agentic-ai-security:agent-harness-review — non-Claude agent runtimes (LangChain/AutoGen/CrewAI/custom loops, computer-use/browser-use agents): intermediate-state poisoning, action-space scoping, runaway-loop limits.
• agentic-ai-security:a2a-security-review — agent-to-agent peer trust: identity/auth, message spoofing, capability-negotiation trust, delegation-chain privilege narrowing.
• ai-safety-engineer:evals-ci-gate + templates/genai-eval-gates/ — a real, drop-in CI workflow (promptfoo + garak) that gates releases on safety/prompt-injection regression vs. a baseline.

New: developer role bundle

The missing non-security-specialist entry point — one agent + a pre-commit-gate skill + /developer:precommit command that orchestrates secrets/gitignore/SAST/SCA/IaC checks into a single go/no-go verdict scoped to the diff. Auto-installs security-knowledge, sast-sca, security-architect, infrastructure-security.

New: real enforcement templates (not just advice)

• templates/security-gates/ — drop-in .pre-commit-config.yaml + GitHub Actions workflow wiring gitleaks/semgrep/bandit/shellcheck/hadolint/checkov, fail-closed on HIGH/CRITICAL, with a burn-in/exceptions rollout guide.
• templates/genai-eval-gates/ — the GenAI equivalent for safety-eval/prompt-injection regression gating.

Install

/plugin marketplace add jassics/awesome-claude-security
/plugin install developer@awesome-claude-security

See docs/INSTALL.md, docs/RECIPES.md, and docs/ROADMAP.md for what's next.

Community project — not affiliated with or endorsed by Anthropic. For authorized security testing, defensive security, GRC, research, education, and CTF use.