Muhammad Basit Ali
I am Muhammad Basit Ali, a cloud security and AI agent security engineer. My day-to-day work is cloud governance: multi-account AWS guardrails, identity and endpoint controls in Microsoft 365, access reviews and the engineering teams that run them. Before that I built backend systems in Python and TypeScript, including a regulated lending platform and real-time grid software. The repositories here are the open part of that work: Claude Code skill packs, MCP servers and linters, threat modelling and static analysis for agent code, and a dataset of AI agent incidents. Each one stands alone, says what it does not do, and backs its security claims with tests.
Projects
Every repository with one line and its install command is on the tools page.
Claude Code skill packs
| Repository | What it is |
|---|---|
| claude-skills | Every skill I maintain, in one repository: 87 skills in 13 plugins from the packs below, one marketplace, one install script, synced daily. |
| ways-of-working-skills | Claude Code skills for ways of working: change requests from a Terraform plan, an action ledger across meeting notes, exception and risk registers, RFC lint, a decision log, weekly status notes, a private 1:1 ledger and focus time from a calendar export. |
| aws-security-skills | AWS security skills for Claude Code: account audit, SCP guardrails, blast-radius landing zones, IAM least privilege, Security Hub triage. |
| repo-engineering-skills | Repository engineering skills for Claude Code: docs checked against the code, audits where every finding cites a line, agent context files that say only what code cannot. |
| m365-governance-skills | Microsoft 365 governance skills for Claude Code: Entra ID posture review, Intune baseline check, Graph permission preflight, Teams and group sprawl, access review pack. |
| compliance-evidence-skills | Compliance evidence skills for Claude Code: integrity-checked evidence packs from GitHub, AWS and Microsoft 365 exports, mapped to ISO 27001 and SOC 2, with narratives that cite evidence or say not assessable. |
| claude-dev-skills | Claude Code skills for everyday development: code review, refactoring, debugging, CI and containers, data and APIs, documentation and security basics. |
| agent-security-skills | Claude Code security plugin and agent skills for securing LLM agents: threat modelling, configuration audits, prompt injection review, MCP server review, incident lookup. |
| github-manager-skills | Claude Code skills for engineering managers that compute from exported GitHub data: stuck-PR and review-queue digest, iteration report, blameless postmortem timeline. |
| mac-maintenance-skills | Claude Code skills for cleaning up and speeding up a Mac: read-only survey first, safe tier removes only what programs recreate, leftovers and duplicate finders. |
| claude-code-tooling-skills | Claude Code skills for keeping a Claude Code setup safe: review a third-party skill before installing it, lint skill descriptions, audit the context budget, build least-privilege permissions, test hooks. |
| agent-identity-governance-skills | Claude Code skills for agent identity governance: inventory the non-human identities agents run as, review permissions, recertify quarterly, catch expiring credentials, switch one off fast. |
MCP tooling
| Repository | What it is |
|---|---|
| dev-mcp-servers | Ten small MCP servers for everyday development and security checks. |
| mcp-server-template | Secure MCP server template in TypeScript and Python, safe by default. |
| mcp-tools-lint | Lint MCP tool schemas and annotations before clients reject them. |
| mcp-auth-doctor | Diagnose OAuth discovery problems on remote MCP servers. |
| mcp-egress | Record every host an MCP server contacts, per tool, and fail CI on new ones. |
| claude-mcp-allow | Least-privilege Claude Code permission rules for MCP tools, generated from their annotations. |
| agentdojo-mcp | Run the AgentDojo benchmark's user and injection tasks against a real MCP server's tools. |
| garak-mcp-probes | Run garak against your own MCP servers, with detectors for denied tool calls, leaked canaries and runaway step counts. |
| mcp-rc-check | MCP specification migration checker for the 2026-07-28 revision: flags removed, changed and deprecated constructs and writes a patch for mechanical fixes. |
Security tooling
| Repository | What it is |
|---|---|
| agent-off-switch | Find every AI agent identity in Microsoft 365, AWS and GitHub, see what it can reach, and switch it off. Offline on saved exports. |
| skill-scan-gate | CI gate for Claude Code skills and plugins, with SARIF output. GitHub Action and CLI. |
| agent-threat-model | Threat modeling for AI agents: describe the system in YAML, get a STRIDE and OWASP Agentic threat model. |
| agent-config-audit | Audit AI agent configuration files for security risks. |
| agentic-semgrep-rules | Semgrep rules for AI agent code in Python, TypeScript and JavaScript. |
| security-actions | GitHub Actions for AI agent and supply chain security checks. |
| cc-hooks | Typed Python SDK and offline test runner for Claude Code hooks. |
| cc-plugin-lock | Lock file for Claude Code plugins: pins plugins and skills to content hashes and verifies them before load. |
| claude-perm-sim | Claude Code permission rule simulator: shows which rule decides a tool call and where a rule set is permissive. |
| llms-txt-gen | Generate llms.txt for any docs site or repository. |
| scp-guardrails | Build AWS service control policies from a short spec and lint them for lockouts and statements that deny nothing. |
| spotlighting | Spotlighting for prompt injection defence in Python: mark untrusted text before it reaches a model. |
| llm-agent-control-plane | Deterministic policy enforcement for LLM agents. |
Data and lists
| Repository | What it is |
|---|---|
| ai-agent-incidents | An open dataset of AI agent and LLM security incidents, with a browsable site. |
| agent-skills-state-2026 | Monthly study of public agent skill, plugin and MCP repositories: dataset, method, hand-checked precision and scripts. |
| awesome-agent-security | Curated list of AI agent security tools, papers and datasets. |
Latest releases
Packages: container images and npm packages are listed on the Packages tab.
Posts
- What do skills that ask for the whole shell do with it?
I read 3,715 public agent skills that grant unscoped Bash. Three in ten never show a shell command, most of the rest need three commands or fewer, and a third install, delete, push or eval. - Do MCP server READMEs tell you which version to run?
I read the install commands in the READMEs of 264 public MCP servers. 95.5% never name an exact version, and a quarter ask for the latest release on every launch. - What the OWASP Agentic Top 10 maps to in 88 real incidents
88 public AI incidents coded against the OWASP Agentic Top 10: which categories show up, what they travel with, and what the list leaves out. - Gating Claude Code skills in CI with a pull request comment
A how-to for skill-scan-gate: block risky skills, hooks and MCP servers in pull requests, adopt it with a baseline, and read its sticky comment. - Do MCP servers say which tools are safe?
I read the tool registrations of 304 public MCP servers. Six in ten mark none of their tools as read-only or destructive, and only one delete-or-send tool in five says it is destructive. - The state of public agent skills and MCP servers
A random sample of 2,999 public repositories that ship agent skills, plugins or MCP servers, scanned and hand-checked. Five findings, with denominators, and what to check before you install one. - Agent identities are the new service accounts
AI agents run as app registrations, IAM roles and GitHub Apps that nobody owns or reviews. The failure modes, the controls, and an offline tool for them. - Four open repositories for securing AI agents, and what each is for
A map of the open tools for AI agent security: an incident dataset, Semgrep rules for agent code, a threat-model CLI and Claude Code skill packs, with where each one stops. - Every Claude Code skill I maintain, in one repository
87 Claude Code skills in 13 plugins from 8 source repositories, now in one repository with one marketplace and one install script.