🔌

defending-code

🔌Plugin

air-gapped/skills

Installation

Add marketplace in Claude Code:

$/plugin marketplace add air-gapped/skills

Step 2. Install plugin:

$/plugin install defending-code@air-gapped-marketplace

What it does

Security find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).

🏪

Part of

air-gapped/skills

security

AddedJul 16, 2026

View on GitHub Back to Plugins

More from this repository10

🎯

helm🎯Skill

Skill

🎯

open-webui-embeddings🎯Skill

Skill

🎯

vllm-speculative-decoding🎯Skill

Skill

🎯

rancher-upgrade🎯Skill

Skill

🎯

vllm-deployment🎯Skill

Skill

🎯

prometheus-mimir-grafana🎯Skill

Skill

🎯

jira-best-practices🎯Skill

Skill

🔌

harvester🔌Plugin

Harvester HCI operator suite — controlled, community-edition Harvester upgrades off an EOL line up to latest stable: the no-skip minor ladder (1.5→1.6→1.7→1.8 carrying embedded RKE2 / KubeVirt / Longhorn / SLE-Micro together), external-Rancher + Harvester UI-extension pairing and ordering, air-gapped version detection, controlling the node-by-node upgrade flow (serial interlock, the v1.7+ pause-map, and the PodDisruptionBudget + VMI-readinessProbe native gate for 1.5/1.6), keeping VM-hosted self-managed RKE2 control planes quorate via anti-affinity spread and live-migration-vs-clean-shutdown tradeoffs (busy-etcd non-convergence, auto-converge, dedicated migration network), per-hop breaking changes (wicked→NetworkManager, Intel NIC rename, DHCP churn), the enforced pre-flight health gates, and the no-downgrade backup/rollback reality. Companion to the k8s suite's k8s-components-checker (Harvester↔Rancher↔RKE2 pairing registry) and rancher-upgrade (the external Rancher's own chain).

🔌

observability🔌Plugin

Observability suite — Prometheus, Grafana Mimir, and Grafana reference for agents querying metrics, writing PromQL, building and fixing dashboards, and reasoning about SLOs, KPIs, and burn-rate alerting.

🎯

secure-boot-cert-rotation🎯Skill

Skill