hunt-credential-access

87

dandye

Hunt for credential access techniques like LSASS dumping or browser credential theft. Use when searching for evidence of credential harvesting. Takes MITRE technique IDs and searches for behavioral indicators in SIEM.

Sigil Security Scanner (sigil-scan)

1

NOMARJ

Automated security auditing for AI agent code. Scans repositories, packages, MCP servers, and installed skills for malicious patterns using an eight-phase analysis: install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance, prompt injection, and skill security. Use when cloning repos, installing packages (pip/npm), reviewing MCP servers, auditing skills, scanning code before execution, or when asked to check if something is safe, audit code, scan for malware, or review dependencies.