ingrainlabs/ingrain-security

Use at BOTH ends of a security-relevant change; it detects which phase to run from repo state, so invoke it at either moment. Each phase owns one moment: Development runs before code for the task exists, Testing after it. **Development — plan review:** run AS THE FINAL STEP of building an implementation plan, ad-hoc inline or in a formal plan-mode / design-doc session — once the plan is comprehensive and detailed (affected files, concrete implementations, tests), but before you present it or write any code. It folds selected threats and adopted mitigations back into that plan. **Testing — verification:** run AFTER you have implemented code for that plan, but before you present or commit it. It measures how robust the applied mitigations are against the branch diff, and reports; the coding agent implements. If there is even a 1% chance the change touches security, invoke it — triage decides whether a full review is warranted.

Claude Skills are markdown + scripts loaded into Claude Code; scanned with the same pipeline.

Source:

github.com/ingrainlabs/ingrain-security

Provenance:

Found by crawling (provenance, not a security rating)

We found this by crawling public sources and nobody has attested to it. That is how most of the registry gets here, and it is not a mark against the artifact — it only means no authenticated act of publication is on record. An artifact can be the vendor's own and still appear here.

2 critical findings reported by agent-audit-kit, 0 of them in the installed artifact. The composite score alone does not reflect this — read the per-scanner reports below.