Agent Skills Index

Directory / Claude community plugins (Anthropic) / backend-security-skills

backend-security-skills

plugin Security

Security auditor for Node.js and Python backend APIs. Four skills cover pre-audit reconnaissance (route graph, auth matrix, invariants), static code audit across the OWASP API Security Top 10 via 8 parallel agents (authz / authn / injection / deserialization-and-ssrf / crypto-and-secrets / resource-and-business-logic / config-and-supply-chain / llm-and-integration), and live HTTP probing that verifies findings with reproducible curl transcripts. Outputs markdown or JSON with severity + CWE + OWASP API Top 10 tags per finding. Built for Express, NestJS, Fastify, Koa, Next.js, FastAPI, Django, Flask, and Starlette.
Description from the marketplace entry / plugin manifest.

Information source

Copied from the Claude community plugins (Anthropic) catalog (anthropics/claude-plugins-community), maintained by Anthropic (community submissions).

Links are pinned to commit 06ec7b6 (2026-10-13), the version we synced. Not reviewed by us.

Install

Add the marketplace (once, in Claude Code)
/plugin marketplace add anthropics/claude-plugins-community
In a Claude Code session
/plugin install backend-security-skills@claude-community
From your shell
claude plugin install backend-security-skills@claude-community

Commands follow each host's documentation (Claude Code, Claude Cowork docs). gh skill needs GitHub CLI 2.90 or later and is in public preview.

Listed from Anthropic (community submissions)'s catalog, not reviewed by us. Read the source before installing.

Catalog
Claude community plugins (Anthropic) (claude-community)
Information source
marketplace.json in anthropics/claude-plugins-community
Author
Not stated in the source
Source code
souzavinny/backend-security-skills
Homepage
github.com/souzavinny/backend-security-skills
License
MIT (repository license)
Repository stars
2 for souzavinny/backend-security-skills
Added to catalog
2026-04-28
Last change
2026-04-27 (last push to the repo)

What it contains

Hosted in an external repository, so contents are not counted here. See the source link.

Similar in Security