🔌

vuln-detector

🔌Plugin

enchanter-ai/hydra

Installation

Add marketplace in Claude Code:

$/plugin marketplace add enchanter-ai/hydra

Step 2. Install plugin:

$/plugin install vuln-detector@hydra

What it does

OWASP Top 10 and CWE-mapped vulnerability detection in code changes. SCOPE TRUTH: a single-line regex prefilter, not a dataflow engine - it cannot follow taint across lines or functions, and several rules are shape-bound to HTTP handlers. Emits COVERAGE alongside findings, so an empty result reports whether the code was actually analysed rather than implying it is clean.

🏪

Part of

enchanter-ai/hydra

security

AddedSep 8, 2026

View on GitHub Back to Plugins

More from this repository10

🔌

state-integrity🔌Plugin

Defense-of-defense layer. Signs and verifies Hydra's own defense-state files (active-canaries.json, egress-policy.json, capability-policy.json, rate-policy.json, hooks.json) so adversarial corruption can't silently disable a guard. Closes R-020 (F-PT-11/12/13/17).

🔌

action-guard🔌Plugin

Pre-execution classification and blocking of dangerous Bash commands.

🔌

egress-monitor🔌Plugin

PostToolUse advisory hook logging every WebFetch/WebSearch/Bash-network destination to append-only NDJSON. First-seen domains surface as stderr advisories.

🔌

full🔌Plugin

Meta-plugin. One install pulls in all 15 Hydra plugins via dependency resolution.

🔌

package-gate🔌Plugin

PreToolUse advisory hook on npm/pip/uv/cargo/go/gem install. Five risk signals: existence, age, maintainer churn, typosquat (Levenshtein), download cliff. 24h URL-hash cache. Closes the supply-chain pre-install gap.

🔌

egress-shield🔌Plugin

Opt-in PreToolUse blocking egress allowlist. Sibling of egress-monitor (advisory). When state/egress-policy.json sets enabled:true, blocks WebFetch/WebSearch/Bash-network calls whose destination host is not in the allowlist. Default disabled. Closes F-005.

🔌

secret-scanner🔌Plugin

Real-time secret detection in written files. 200+ patterns, Shannon entropy, Aho-Corasick matching.

🔌

capability-fence🔌Plugin

Best-effort subagent-escape detection. PreToolUse hook compares the invoked tool against the active skill's allowed-tools frontmatter; logs out-of-lane invocations. Observability only — runtime sandboxing requires harness/SDK work.

🔌

license-gate🔌Plugin

License compliance scanner over npm + pip dep trees against an allow/deny SPDX policy. Flags GPL/AGPL/SSPL as denied, MPL/EPL/CDDL as warned, MIT/Apache/BSD/ISC as allowed. CI-mode supports --fail-on-deny. Skill-invoked + release-workflow gate.

🔌

config-shield🔌Plugin

Session-start scanning for malicious repository configuration files.