<Devsly/>
NotebookLM Watermark Remover
Remove the NotebookLM watermark from PDF slide exports — free, unlimited, and 100% in your browser.
View
NotebookLM Video Watermark Remover
Remove the NotebookLM watermark from every frame of your MP4 and auto-trim the end card — free and unlimited.
View
Gemini Watermark Remover
Remove the Gemini (Veo) sparkle watermark from every frame of your AI-generated MP4 — free and unlimited.
View
MCP https://devsly.io/mcp MCP Tools Best Skills API Docs
Devsly

Keyboard Shortcuts

Navigation

Quick Search
⌘ / Ctrl + K
Toggle Dark Mode
⌘ / Ctrl + D
Close Dialogs
Esc

Tool Actions

Execute / Process
⌘ / Ctrl + Enter
Clear Input
⌘ / Ctrl + Shift + C
Copy Output
⌘ / Ctrl + Shift + X

Editor

Select All
⌘ / Ctrl + A
Undo
⌘ / Ctrl + Z
Redo
⌘ / Ctrl + Shift + Z

Updated today

by dmdhrumilmistry

security-harness

A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README/JSON/SARIF/doc/PDF.

  • Active — Updated in the last 14 days
Works with
  • Claude
View on GitHub (opens in a new tab)

43 GitHub stars (43)

+4 in 16 days

Stars gained per day · daily snapshots since Sep 30
Stars gained per day, Sep 30 to Oct 16: +4 in total; the busiest day was Oct 4 with +1 stars.Oct 1: 0 starsOct 2: 0 starsOct 3: 0 starsOct 4: +1 starsOct 5: 0 starsOct 6: +1 starsOct 7: 0 starsOct 8: 0 starsOct 9: 0 starsOct 10: 0 starsOct 11: 0 starsOct 12: 0 starsOct 13: +1 starsOct 14: 0 starsOct 15: +1 starsOct 16: 0 stars
Stars gained between daily snapshots
PeriodNew stars
Oct 10
Oct 20
Oct 30
Oct 4+1
Oct 50
Oct 6+1
Oct 70
Oct 80
Oct 90
Oct 100
Oct 110
Oct 120
Oct 13+1
Oct 140
Oct 15+1
Oct 160
  • 18 skills (18 skills found in its SKILL.md files)
  • 11 forks (11 forks)
  • Today last update (Last updated today)

Install

Skills CLI

npx skills add dmdhrumilmistry/security-harness

Asks which skills and agents to install. Just one: npx skills add dmdhrumilmistry/security-harness --skill sh-kb-access-control — add -g for every project.

Claude Code

git clone https://github.com/dmdhrumilmistry/security-harnesscp -r "security-harness/skills/sh-kb-access-control" ~/.claude/skills/

Copies the sh-kb-access-control skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.

Plugin

/plugin marketplace add dmdhrumilmistry/security-harness

Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.

Skills can run code on your machine — read the SKILL.md first.

What it does

In the author's own words, from each skill's SKILL.md — showing the first 18 of 36 files.

  • sh-kb-access-control

    Knowledge base for finding broken access control - IDOR/BOLA, missing function-level authorization, privilege escalation, and multi-tenant isolation failures. Use when hunting authorization issues or reviewing whether users can access resources/actions they shouldn't. CWE-284/285/639/862/863, OWASP A01:2021-Broken Access Control.

    skills/sh-kb-access-control/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-auth

    Knowledge base for finding authentication and session-management failures - weak login, broken JWT/session handling, password/reset flaws, MFA bypass, credential storage issues. Use when hunting authentication (not authorization - see sh-kb-access-control). CWE-287/384/613/620/640, OWASP A07:2021-Identification and Authentication Failures.

    skills/sh-kb-auth/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-crypto

    Knowledge base for finding cryptographic failures - weak hashing/encryption, insecure randomness, hardcoded/static keys and IVs, ECB mode, missing integrity, and predictable tokens. Use when hunting crypto misuse. CWE-327/328/330/326/916, OWASP A02:2021-Cryptographic Failures.

    skills/sh-kb-crypto/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-csrf

    Knowledge base for finding Cross-Site Request Forgery - state-changing requests that rely only on ambient credentials (cookies) with no anti-CSRF token or SameSite protection. Use when hunting CSRF. CWE-352, OWASP A01:2021-Broken Access Control.

    skills/sh-kb-csrf/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-deserialization

    Knowledge base for finding insecure deserialization - untrusted data fed to object-deserialization APIs that can trigger RCE or object injection via gadget chains. Use when hunting deserialization issues. CWE-502, OWASP A08:2021-Software and Data Integrity Failures.

    skills/sh-kb-deserialization/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-file-upload

    Knowledge base for finding unrestricted/insecure file upload - uploads that allow dangerous file types, execution in the upload dir, path control over the stored name, or missing content validation, leading to RCE, XSS, or overwrite. Use when hunting file-upload issues. CWE-434/436/616, OWASP A04/A05:2021.

    skills/sh-kb-file-upload/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-injection

    Knowledge base for finding command/OS injection, template injection (SSTI), code injection (eval), and LDAP/NoSQL/expression injection. Use when hunting injection into shells, template engines, interpreters, or directory queries. CWE-77/78/94/917, OWASP A03:2021-Injection.

    skills/sh-kb-injection/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-open-redirect

    Knowledge base for finding open/unvalidated redirects - user-controlled redirect targets that send victims to attacker sites, enabling phishing, token leakage, and OAuth/SSO abuse. Use when hunting open redirects. CWE-601, OWASP A01:2021-Broken Access Control.

    skills/sh-kb-open-redirect/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-path-traversal

    Knowledge base for finding path/directory traversal and local/remote file inclusion - user-controlled paths reaching filesystem or include operations, enabling arbitrary file read/write or code inclusion. Use when hunting traversal/LFI/RFI. CWE-22/23/98, OWASP A01:2021-Broken Access Control.

    skills/sh-kb-path-traversal/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-race-conditions

    Knowledge base for finding race conditions and TOCTOU flaws - concurrent requests exploiting non-atomic check-then-act logic (double-spend, limit bypass, balance manipulation, file TOCTOU). Use when hunting concurrency/business-logic race bugs. CWE-362/367/366, OWASP A04:2021-Insecure Design.

    skills/sh-kb-race-conditions/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-secrets

    Knowledge base for finding hardcoded secrets and sensitive-data exposure - API keys, passwords, tokens, private keys, and connection strings embedded in source/config, or secrets leaked to logs/errors/URLs. Use when hunting secret exposure. CWE-798/259/312/532, OWASP A05/A02:2021.

    skills/sh-kb-secrets/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-sqli

    Knowledge base for finding SQL injection (and query-language injection). Use when hunting SQLi, or when a hunter/reviewer needs sources, sinks, detection queries, payloads, false-positive filters, and remediation for injection into SQL/ORM raw queries. CWE-89, OWASP A03:2021-Injection.

    skills/sh-kb-sqli/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-ssrf

    Knowledge base for finding Server-Side Request Forgery - when the server makes outbound requests to attacker-controlled destinations. Use when hunting SSRF or reviewing URL/host inputs that reach HTTP/network clients. CWE-918, OWASP A10:2021-SSRF.

    skills/sh-kb-ssrf/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-xss

    Knowledge base for finding Cross-Site Scripting - reflected, stored, and DOM-based XSS. Use when hunting XSS or reviewing untrusted data rendered into HTML/JS/attributes without context-correct encoding. CWE-79, OWASP A03:2021-Injection.

    skills/sh-kb-xss/SKILL.md on GitHub (opens in a new tab)

  • sh-kb-xxe

    Knowledge base for finding XML External Entity injection - XML parsers configured to resolve external/general entities on untrusted input, enabling file read, SSRF, and DoS. Use when hunting XXE. CWE-611/776/827, OWASP A05:2021-Security Misconfiguration.

    skills/sh-kb-xxe/SKILL.md on GitHub (opens in a new tab)

  • sh-pr-review

    Security-review a GitHub pull request, post the result as inline review comments on the PR, and set a pass/fail commit status that branch protection can enforce. Fails the PR for vulnerabilities it introduces or makes worse; passes with a warning for pre-existing ones. Triages the diff first and scales depth to risk, dedupes across re-pushes, and never posts without an explicit yes. Use when revi…

    skills/sh-pr-review/SKILL.md on GitHub (opens in a new tab)

  • sh-router

    Entry point / dispatcher for the security-harness. Use when the user asks for any application-security work - 'security review', 'audit this codebase', 'pentest', 'find vulnerabilities', 'check for SQLi/XSS/IDOR/SSRF', 'generate a security report/SARIF'. Interprets the request and routes it to the full sh-security-review pipeline, a single stage, or a single vulnerability-class knowledge base.

    skills/sh-router/SKILL.md on GitHub (opens in a new tab)

  • sh-security-review

    Run the full multi-agent security review pipeline on a codebase - recon/mapping (Graft + SBOM/CVE), parallel vulnerability hunting backed by ~15 per-class knowledge bases, escalation chaining, impact verification, and reporting to README/JSON/SARIF/doc/PDF. Use when the user asks to security-review, audit, pentest, or find vulnerabilities in a codebase. Usually invoked via the sh-router skill.

    skills/sh-security-review/SKILL.md on GitHub (opens in a new tab)

Review before you install

A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.