Phoenix Security Skills plugin
Six Claude Code plugins from Phoenix Security: security review, readiness gates, SAST rules, threat search and secure PRDs.
- 84 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Skills read the whole repository and `tm-security-review` builds a working proof of an exploit
- The NotebookLM skill drives a browser and keeps a Google account login
- The search CLI sends queries to external services using your key
Install
- Works in
Manual install
/plugin marketplace add Security-Phoenix-demo/security-skills-claude-codeAfter adding the marketplace install plugins one at a time, for example `/plugin install phoenix-security-review@phoenix-security`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Skills read the whole repository and `tm-security-review` builds a working proof of an exploit
- The NotebookLM skill drives a browser and keeps a Google account login
- The search CLI sends queries to external services using your key
This is third-party code. Review the repository files before installing.
What it does
The repository is a marketplace of six plugins and 27 skills for development security. `phoenix-security-review` combines a pre-merge review, a whole-repo sweep against OWASP Top 10 and ASVS level 1, a diff-scoped scan for zero-day issues and a STRIDE and DREAD threat model. `phoenix-readiness-reviews` gives two verdicts: the plan is ready or not, and the code can ship or cannot. A deterministic repository scanner runs before the second one. Next, `phoenix-sast-rules` writes opengrep and semgrep rules for more than 30 languages, `phoenix-cti-search` searches 595 threat sources, `phoenix-prd-pipeline` takes requirements through 12 roles from context cleaning to a release decision, and `phoenix-docs-research` generates project documentation and queries NotebookLM. Every skill is also a slash command of the same name.
Who it is for. AppSec and DevSecOps teams that want security review, threat models and readiness checks inside Claude Code.
Good fit when
- Before a merge the change must pass an eight-point check for Python, TypeScript, Go, Java, Rust, Ruby or .NET
- A new feature needs a threat model and abuse cases before development starts
- A CWE class vulnerability is known and you need semgrep or opengrep rules with tests for it
- You want to test a spec before launch: could another team build the product without guessing
- You need intelligence about an attack from specialist sources, collected into a NotebookLM notebook
Not a fit when
- You need a continuous dependency and secret scanner in CI: the plugins run on demand inside a Claude Code session
- You need a formal audit with sign-off: skill verdicts advise and do not replace a specialist
- You need to work offline: threat search and NotebookLM call external services
Example request
Run `/security-review` on my branch changes, then build a threat model for the new payment endpoint.Limitations
All plugins target Claude Code. The search CLI and MCP server need Node 18 or newer and a Brave Search or SerpAPI key. The `notebooklm` skill drives a browser and keeps a Google account login, and `phoenix-security-review` has three optional hooks that you enable separately. The `tm-security-review` skill by design builds a working proof of an exploit, so run it only on code you own. In `phoenix-readiness-reviews` percentages always carry a count of checked items, and unverifiable items are marked separately.
How to disable. Remove unneeded plugins with `/plugin uninstall <name>@phoenix-security` and drop the marketplace with `/plugin marketplace remove`. Clear the Google login saved by the `notebooklm` skill separately.
FAQ
How do I install the Phoenix Security plugins?
Add the marketplace with `/plugin marketplace add Security-Phoenix-demo/security-skills-claude-code` and install plugins one by one: `/plugin install phoenix-security-review@phoenix-security`. Each plugin stands alone.
What do the readiness reviews differ in?
`plan-readiness-review` assesses a PRD, spec or RFC and returns READY or NOT READY. `production-readiness-review` checks a repository and branch against the plan and answers SHIP or NO-SHIP.
Is a key needed for threat search?
The `cti-domain-research` skill itself works without a key. The bundled Node CLI and MCP server need a Brave Search or SerpAPI key.
How many roles are in the PRD pipeline?
Twelve: from context cleaning and scope to a verification matrix, delivery plan and the final SHIP or NO_SHIP decision. All roles live in the `phoenix-prd-pipeline` plugin.
What SAST rules can I get?
`opengrep-rule-generator` writes search rules and taint rules for more than 30 languages. The `-research` variant first studies a CVE or CWE on the web and then prepares the rules.
Discussion
No questions or reviews yet.
Related
PluginsA code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
Trail of Bits skills
Trail of Bits Skills Marketplace
Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing
A skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
A security audit skill built on OWASP Top 10, CWE and CVSS, with deep PHP and TYPO3 scanning across 80-plus checkpoints.
Ten pentest skills for Claude Code and Gemini CLI: recon, SQL injection, XSS, LFI and a report, driven by plain-language requests
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Phoenix Security Skills (this card) | yes | 84 | |
| Trail of Bits skills | no | 8,165 | the Trail of Bits marketplace: smart contracts, C/C++ and Rust with more weight on code audit |
| Semgrep Skills | yes | 342 | three Semgrep skills for secure coding and LLM apps without threat models or PRDs |
| STRIDE GPT | no | 1,154 | a CLI that builds a STRIDE threat model from project code |
README in short
The page opens with install commands, then describes the two new readiness review skills, a table of six plugins and all 27 skills. Sections per direction follow: threat source search, NotebookLM, a research pipeline, the PRD generator, SAST rules, project documentation and the security assessment suite.