Agent Plugins Marketplace
← All plugins

security-engineering

v0.3.8

Security-engineering (AppSec) team — agents (appsec-engineer, threat-modeler, supply-chain-security-engineer, cloud-security-engineer) for building security INTO software: threat modeling (STRIDE, data-flow diagrams, trust boundaries), application security testing (SAST/DAST/IAST/SCA in CI, OWASP Top 10 web), secrets management (detection, rotation, vaulting, no plaintext), software supply-chain integrity (SBOM consumption, dependency CVEs, SLSA verification, pinning), and cloud security posture (CSPM, IAM least-privilege, network exposure). skills, a decision-tree knowledge bank (vuln-triage + secrets-handling trees + a dated 2026 tooling map), best-practices, templates, commands, an advisory hook. **Proposes controls; every ship/no-ship security VERDICT escalates to ravenclaude-core/security-reviewer.** Seams: API OWASP -> api-engineering, identity -> auth-identity, data privacy -> data-governance-privacy. Requires ravenclaude-core@>=0.7.0.

Claude Code5 Skills

By Matt CorbettLicense: MIT7 GitHub starsUpdated last week

Directory evidence

Runtimes
Claude Code
Parsed components
5 skill or MCP entries
Source updated
Sep 15, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install security-engineering for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install security-engineering@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/mcorbett51090/RavenClaude

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/security-engineering/.

Plugin files

plugins/security-engineering/
├── .claude-plugin/plugin.json
├── skills/appsec-scanning/SKILL.md
├── skills/secrets-detection-and-remediation/SKILL.md
├── skills/secrets-management/SKILL.md
├── skills/supply-chain-security/SKILL.md
└── skills/threat-modeling-stride/SKILL.md

Included Skills5

appsec-scanningskills/appsec-scanning/SKILL.md

Stand up tuned application security scanning in CI: SAST + SCA per-PR, DAST on a deployed build, secret-scanning, and triage by exploitability×blast-radius rather than raw CVSS.

secrets-detection-and-remediationskills/secrets-detection-and-remediation/SKILL.md

Playbook for detecting secrets committed to Git — pre-commit hooks, CI scanning, historical repo scanning — and the full remediation procedure when a secret is found: rotation, history rewrite, and the post-incident checklist.

secrets-managementskills/secrets-management/SKILL.md

Manage secrets safely: detect them in code/config/logs, vault them, federate with short-lived credentials, rotate on a schedule, and treat any committed secret as compromised (rotate, don't just delete).

supply-chain-securityskills/supply-chain-security/SKILL.md

Secure the software supply chain from the consume side: ingest the SBOM, triage CVEs by reachability, pin dependencies with a deliberate update cadence, verify SLSA provenance, and defend against malicious packages.

threat-modeling-strideskills/threat-modeling-stride/SKILL.md

Threat-model a design with STRIDE: draw the data-flow diagram and trust boundaries, walk STRIDE per element, rank threats by likelihood×impact, and map each to a mitigation or a routed accepted-risk.

Plugin manifests1

plugins/security-engineering/.claude-plugin/plugin.json
{
  "name": "security-engineering",
  "version": "0.3.8",
  "description": "Security-engineering (AppSec) team — agents (appsec-engineer, threat-modeler, supply-chain-security-engineer, cloud-security-engineer) for building security INTO software: threat modeling (STRIDE, data-flow diagrams, trust boundaries), application security testing (SAST/DAST/IAST/SCA in CI, OWASP Top 10 web), secrets management (detection, rotation, vaulting, no plaintext), software supply-chain integrity (SBOM consumption, dependency CVEs, SLSA verification, pinning), and cloud security posture (CSPM, IAM least-privilege, network exposure). skills, a decision-tree knowledge bank (vuln-triage + secrets-handling trees + a dated 2026 tooling map), best-practices, templates, commands, an advisory hook. **Proposes controls; every ship/no-ship security VERDICT escalates to ravenclaude-core/security-reviewer.** Seams: API OWASP -> api-engineering, identity -> auth-identity, data privacy -> data-governance-privacy. Requires ravenclaude-core@>=0.7.0.",
  "author": {
    "name": "Matt Corbett"
  },
  "homepage": "https://github.com/mcorbett51090/RavenClaude",
  "license": "MIT",
  "keywords": [
    "security",
    "appsec",
    "threat-modeling",
    "stride",
    "sast",
    "dast",
    "sca",
    "owasp",
    "owasp-top-10",
    "secrets-management",
    "supply-chain",
    "sbom",
    "slsa",
    "cspm",
    "least-privilege",
    "dependency-scanning"
  ],
  "requires": {
    "plugins": [
      "ravenclaude-core@>=0.7.0"
    ]
  }
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[security-engineering on Agent Plugins Marketplace](https://pluginsmp.com/plugins/security-engineering)