Plugin

Security Toolkit

Four defensive security skills covering OWASP Top 10 and supply-chain hardening: pre-deployment audit checklists, secure authentication (hashing, sessions, JWT, OAuth, passkeys), API hardening (rate limiting, CORS, throttling), and npm/bun install-time cooldown with a sandboxed bypass scan.

Type: Plugin
Repository: jamditis/claude-skills-journalism
GitHub stars: 403
License: MIT
Repo last updated: Sep 25, 2026
Source file: security-toolkit/.claude-plugin/plugin.json
Version: 1.2.3
Author: Joe Amditis

What Security Toolkit is

Security Toolkit is a plugin published in the jamditis/claude-skills-journalism repository on GitHub, which has about 403 stars. The repository describes itself as: “Claude Code skills for journalism, media, and academia - verification, FOIA, data journalism, academic writing, and more”

A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.

Installing Security Toolkit adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.

How to install Security Toolkit

Claude Code

Add the repository as a plugin marketplace: claude plugin marketplace add jamditis/claude-skills-journalism
Install the plugin: claude plugin install security-toolkit@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
Restart the session if the new skills or commands don't appear straight away.

Claude Cowork

Open Customize → Plugins and choose Add marketplace.
Enter jamditis/claude-skills-journalism (the owner/repo shorthand works for GitHub).
Find Security Toolkit in the list, click Install, then connect any connectors it needs from its Connectors tab.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from security-toolkit/.claude-plugin/plugin.json, shared under the repository's MIT license. Read the full file on GitHub.

Four defensive security skills for web applications, APIs, and toolchain hardening, pre-deployment audit, authentication patterns, API hardening, and npm/bun supply-chain hardening.

Skills in this plugin

Codex compatibility

The four shared skills remain candidates, not a tested package-wide Codex workflow. The project-copy preflight records activation observations, blocked filesystem reads, and a missing-resource boundary: copying only skills/supply-chain-hardening/ does not include the package-level scan script or synthetic fixture. Do not run its quick-start as though those resources were installed with the skill.

/security-toolkit:hotpatch and its sandbox, cooldown-bypass, and install lifecycle are Claude-only. No Codex command adapter is provided or approved.

Slash commands (Claude Code only)

Reference script + test fixture

scripts/hotpatch.example.sh, Linux/bwrap reference implementation of the scan. Copy and adapt for your machine.
test-fixtures/fake-mini-shai.tgz, synthetic malicious tarball. Run bash scripts/hotpatch.example.sh --self-test to verify the heuristics fire (expected: 2 red, 1 yellow, SELF-TEST PASSED).

Installation

/plugin marketplace add jamditis/claude-skills-journalism
/plugin install security-toolkit@claude-skills-journalism

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Security Toolkit?

Security Toolkit is a plugin for Claude Code and Claude Cowork from the jamditis/claude-skills-journalism repository on GitHub. Four defensive security skills covering OWASP Top 10 and supply-chain hardening: pre-deployment audit checklists, secure authentication (hashing, sessions, JWT, OAuth, passkeys), API hardening (rate limiting, CORS, throttling), and npm/bun install-time cooldown with a sandboxed bypass scan.

How do I install Security Toolkit in Claude Code?

Add the repository as a plugin marketplace: claude plugin marketplace add jamditis/claude-skills-journalism Install the plugin: claude plugin install security-toolkit@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.

Can I use Security Toolkit in Claude Cowork?

Open Customize → Plugins and choose Add marketplace. Enter jamditis/claude-skills-journalism (the owner/repo shorthand works for GitHub). Find Security Toolkit in the list, click Install, then connect any connectors it needs from its Connectors tab.

Is Security Toolkit safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under MIT. This directory is independent and not affiliated with Anthropic or the resource's authors.