← Claude plugins
CLAUDE PLUGIN

security-sweep

onomeaj v1.0.0

Comprehensive security scanner for codebases. Scans for hardcoded secrets (30+ API key formats), injection flaws (SQLi, XSS, command injection, SSRF), authentication issues (JWT misuse, weak passwo...

Create a free account to save this plugin.

From the developer

License

MIT

Declared components

Skills

Works with

Claude Code

Description

From the marketplace listing

Comprehensive security scanner for codebases. Scans for hardcoded secrets (30+ API key formats), injection flaws (SQLi, XSS, command injection, SSRF), authentication issues (JWT misuse, weak password hashing)misconfigurations (CORS, debug mode, insecure TLS, Docker/K8s), dependency risks, AI-specific vulnerabilities (prompt injection, API key exposure, excessive agent permissions), mobile security issues (Android/iOS), and data exposure (PII in logs, weak crypto). Covers OWASP Top 10 (2025), Mobile Top 10 (2024), and LLM Top 10 (2025). Supports Python, JavaScript/TypeScript, Java/Kotlin, Go, Ruby, PHP, C#, Swift, and Dart with framework-aware checks that reduce false positives.

What changed

No changes recorded yet. Follow this plugin to keep track of future changes.

Keywords

Files & skills

security-sweep · catalog manifest

Saved declaration

{}
security-sweep · catalog manifest

Saved declaration

{
  "name": "security-sweep",
  "source": {
    "sha": "6ca48b6ef582b5c6050e717202b3e35fa575449c",
    "url": "https://github.com/Onome-AJ/security-sweep-plugin.git",
    "source": "url"
  },
  "homepage": "https://github.com/Onome-AJ/security-sweep-plugin#readme",
  "description": "Comprehensive security scanner for codebases. Scans for hardcoded secrets (30+ API key formats), injection flaws (SQLi, XSS, command injection, SSRF), authentication issues (JWT misuse, weak password hashing)misconfigurations  (CORS, debug mode, insecure TLS, Docker/K8s), dependency risks, AI-specific vulnerabilities (prompt injection, API key exposure, excessive agent  permissions), mobile security issues (Android/iOS), and data exposure (PII in logs, weak crypto). Covers OWASP Top 10 (2025), Mobile Top 10 (2024), and LLM Top 10 (2025). Supports Python, JavaScript/TypeScript, Java/Kotlin, Go, Ruby, PHP, C#, Swift, and Dart with framework-aware checks that reduce false\npositives."
}
security-sweep · catalog manifest

Skills

"./skills/"

Saved declaration

{
  "name": "security-sweep",
  "author": {
    "url": "https://github.com/onomeaj",
    "name": "onomeaj"
  },
  "skills": "./skills/",
  "license": "MIT",
  "version": "1.0.0",
  "homepage": "https://github.com/onomeaj/security-sweep-plugin",
  "keywords": [
    "security",
    "vulnerability-scanner",
    "owasp",
    "secrets-detection",
    "sast",
    "code-audit",
    "injection",
    "xss",
    "sql-injection",
    "mobile-security",
    "ai-security"
  ],
  "repository": "https://github.com/onomeaj/security-sweep-plugin",
  "description": "Comprehensive security scanner for codebases — finds hardcoded secrets, injection flaws, auth issues, misconfigurations, AI-specific vulnerabilities, and more. Covers OWASP Top 10, Mobile Top 10, and LLM Top 10."
}

plugin.json observed Nov 6, 2026 · 10:48 UTC. Manifest source ↗

Catalog declarations and available plugin.json metadata are saved. Referenced skills and executable source files are not downloaded or tested. Missing components in a manifest do not prove that the plugin has none.

Installation instructions

Community

/plugin marketplace add anthropics/claude-plugins-community
/plugin install security-sweep@claude-community

Claude Code installation documentation

Technical details
Sources
Community
First seen
Oct 3, 2026 · 22:13 UTC
Last seen
Nov 7, 2026 · 18:00 UTC
Latest observed change
Oct 3, 2026 · 22:13 UTC
Collection status
Listed
Reported installs
Not provided

Installation counts are source-reported, not independently verified active users. Observation dates are not release dates.

Download plugin data (JSON)

Plugin history: freshly prepared. Prepared . Refreshed when catalog data changes or after 6 hours. Your account and Follow status are live.