I am a cloud security and AI agent security engineer. I build tooling for AWS guardrails, Microsoft 365 governance, MCP servers and Claude Code skills. Everything below is open source and each repository stands on its own.
agent-off-switch finds every AI agent identity in Microsoft 365, AWS and GitHub, ranks what each one can reach, and prints an ordered runbook to switch it off. It runs offline on saved read-only exports and never executes the commands it prints.
aos review examples/demo-tenantThe demo tenant ships with the repository: four agent identities nobody owns, including an AWS role with * on * and a mail agent with tenant-wide Mail.ReadWrite.
| Repository | What it is |
|---|---|
| claude-skills | Every skill I maintain, in one repository: 87 skills in 13 plugins from the packs below, one marketplace, one install script, synced daily. |
| ways-of-working-skills | Claude Code skills for ways of working: change requests from a Terraform plan, an action ledger across meeting notes, exception and risk registers, RFC lint, a decision log, weekly status notes, a private 1:1 ledger and focus time from a calendar export. |
| aws-security-skills | AWS security skills for Claude Code: account audit, SCP guardrails, blast-radius landing zones, IAM least privilege, Security Hub triage. |
| repo-engineering-skills | Repository engineering skills for Claude Code: docs checked against the code, audits where every finding cites a line, agent context files that say only what code cannot. |
| m365-governance-skills | Microsoft 365 governance skills for Claude Code: Entra ID posture review, Intune baseline check, Graph permission preflight, Teams and group sprawl, access review pack. |
| compliance-evidence-skills | Compliance evidence skills for Claude Code: integrity-checked evidence packs from GitHub, AWS and Microsoft 365 exports, mapped to ISO 27001 and SOC 2, with narratives that cite evidence or say not assessable. |
| claude-dev-skills | Claude Code skills for everyday development: code review, refactoring, debugging, CI and containers, data and APIs, documentation and security basics. |
| agent-security-skills | Claude Code security plugin and agent skills for securing LLM agents: threat modelling, configuration audits, prompt injection review, MCP server review, incident lookup. |
| github-manager-skills | Claude Code skills for engineering managers that compute from exported GitHub data: stuck-PR and review-queue digest, iteration report, blameless postmortem timeline. |
| mac-maintenance-skills | Claude Code skills for cleaning up and speeding up a Mac: read-only survey first, safe tier removes only what programs recreate, leftovers and duplicate finders. |
| Repository | What it is |
|---|---|
| dev-mcp-servers | Ten small MCP servers for everyday development and security checks. |
| mcp-server-template | Secure MCP server template in TypeScript and Python, safe by default. |
| mcp-tools-lint | Lint MCP tool schemas and annotations before clients reject them. |
| mcp-auth-doctor | Diagnose OAuth discovery problems on remote MCP servers. |
| mcp-egress | Record every host an MCP server contacts, per tool, and fail CI on new ones. |
| claude-mcp-allow | Least-privilege Claude Code permission rules for MCP tools, generated from their annotations. |
| Repository | What it is |
|---|---|
| agent-threat-model | Threat modeling for AI agents: describe the system in YAML, get a STRIDE and OWASP Agentic threat model. |
| agent-config-audit | Audit AI agent configuration files for security risks. |
| agentic-semgrep-rules | Semgrep rules for AI agent code in Python, TypeScript and JavaScript. |
| security-actions | GitHub Actions for AI agent and supply chain security checks. |
| cc-hooks | Typed Python SDK and offline test runner for Claude Code hooks. |
| cc-plugin-lock | Lock file for Claude Code plugins: pins plugins and skills to content hashes and verifies them before load. |
| claude-perm-sim | Claude Code permission rule simulator: shows which rule decides a tool call and where a rule set is permissive. |
| llms-txt-gen | Generate llms.txt for any docs site or repository. |
| Repository | What it is |
|---|---|
| ai-agent-incidents | An open dataset of AI agent and LLM security incidents, with a browsable site. |
| awesome-agent-security | Curated list of AI agent security tools, papers and datasets. |
Packages: published packages are listed at github.com/basitalisandhu?tab=packages.
| Project | Latest release | Published |
|---|---|---|
| aws-security-skills | v0.4.0 | 2026-10-09 |
| repo-engineering-skills | v0.4.1 | 2026-10-09 |
| m365-governance-skills | v0.5.0 | 2026-10-13 |
| compliance-evidence-skills | v0.3.0 | 2026-10-09 |
| claude-dev-skills | v0.3.0 | 2026-10-09 |
| agent-security-skills | v0.3.0 | 2026-10-09 |
| dev-mcp-servers | v0.2.0 | 2026-10-09 |
| mcp-server-template | v0.2.0 | 2026-10-09 |
| mcp-tools-lint | v0.2.0 | 2026-10-09 |
| mcp-auth-doctor | v0.2.0 | 2026-10-09 |
| mcp-egress | v0.1.1 | 2026-10-05 |
| claude-mcp-allow | v0.2.0 | 2026-10-09 |
| agent-threat-model | v0.2.0 | 2026-10-09 |
| agent-config-audit | v0.2.0 | 2026-10-09 |
| agentic-semgrep-rules | v0.1.0 | 2026-10-04 |
| security-actions | v0.1.0 | 2026-10-04 |
| cc-hooks | v0.1.1 | 2026-10-05 |
| cc-plugin-lock | v0.2.0 | 2026-10-09 |
| claude-perm-sim | v0.2.0 | 2026-10-09 |
| llms-txt-gen | v0.2.0 | 2026-10-09 |
| ai-agent-incidents | no public release yet | |
| awesome-agent-security | no public release yet |
- GitHub: @basitalisandhu
- Questions about a project: open an issue in that project's repository.