CodexPluginStats
← Claude plugins
CLAUDE PLUGIN

backend-security-skills

Marcus Souza v0.2.2

Security auditor for Node.js and Python backend APIs. Four skills cover pre-audit reconnaissance (route graph, auth matrix, invariants), static code audit across the OWASP API Security Top 10 via 8...

Create a free account to save this plugin.

From the developer

License

MIT

Works with

Claude Code

Description

From the marketplace listing

Security auditor for Node.js and Python backend APIs. Four skills cover pre-audit reconnaissance (route graph, auth matrix, invariants), static code audit across the OWASP API Security Top 10 via 8 parallel agents (authz / authn / injection / deserialization-and-ssrf / crypto-and-secrets / resource-and-business-logic / config-and-supply-chain / llm-and-integration), and live HTTP probing that verifies findings with reproducible curl transcripts. Outputs markdown or JSON with severity + CWE + OWASP API Top 10 tags per finding. Built for Express, NestJS, Fastify, Koa, Next.js, FastAPI, Django, Flask, and Starlette.

Source repository ↗ Website ↗

What changed

No changes recorded yet. Follow this plugin to keep track of future changes.

Keywords

Files & skills

backend-security-skills · catalog manifest

Saved declaration

{}
backend-security-skills · catalog manifest

Saved declaration

{
  "name": "backend-security-skills",
  "source": {
    "ref": "main",
    "sha": "ee05fc022a7441bc275d044d67b814e2cd22269f",
    "url": "https://github.com/souzavinny/backend-security-skills.git",
    "path": "plugin",
    "source": "git-subdir"
  },
  "homepage": "https://github.com/souzavinny/backend-security-skills",
  "description": "Security auditor for Node.js and Python backend APIs. Four skills cover pre-audit reconnaissance (route graph, auth matrix, invariants), static code audit across the OWASP API Security Top 10 via 8 parallel agents (authz / authn / injection / deserialization-and-ssrf / crypto-and-secrets / resource-and-business-logic / config-and-supply-chain / llm-and-integration), and live HTTP probing that verifies findings with reproducible curl transcripts. Outputs markdown or JSON with severity + CWE + OWASP API Top 10 tags per finding. Built for Express, NestJS, Fastify, Koa, Next.js, FastAPI, Django, Flask, and Starlette."
}
backend-security-skills · catalog manifest

Saved declaration

{
  "name": "backend-security-skills",
  "author": {
    "name": "Marcus Souza"
  },
  "license": "MIT",
  "version": "0.2.2",
  "keywords": [
    "security",
    "audit",
    "api",
    "backend",
    "nodejs",
    "python",
    "express",
    "nestjs",
    "fastify",
    "fastapi",
    "django",
    "flask",
    "owasp",
    "owasp-api-top-10",
    "bola",
    "sast",
    "dast",
    "pentest",
    "llm-security",
    "prompt-injection"
  ],
  "description": "Security auditor for Node.js and Python backend APIs. Four skills: pre-audit reconnaissance, static code audit with 8 parallel OWASP API Top 10 agents, and live HTTP probing that verifies findings with reproducible curl transcripts. Outputs markdown or JSON with severity, CWE, and OWASP tags per finding. Built for Express, NestJS, Fastify, Koa, Next.js, FastAPI, Django, Flask, and Starlette."
}

plugin.json observed Nov 6, 2026 · 10:41 UTC. Manifest source ↗

Catalog declarations and available plugin.json metadata are saved. Referenced skills and executable source files are not downloaded or tested. Missing components in a manifest do not prove that the plugin has none.

Installation instructions

Community

/plugin marketplace add anthropics/claude-plugins-community
/plugin install backend-security-skills@claude-community

Claude Code installation documentation

Technical details
Sources
Community
First seen
Oct 3, 2026 · 22:13 UTC
Last seen
Nov 7, 2026 · 06:00 UTC
Latest observed change
Oct 3, 2026 · 22:13 UTC
Collection status
Listed
Reported installs
Not provided

Installation counts are source-reported, not independently verified active users. Observation dates are not release dates.

Download plugin data (JSON)

Plugin history: served from cache. Prepared . Refreshed when catalog data changes or after 6 hours. Your account and Follow status are live.