Updated 1d ago
by dmdhrumilmistry
security-harness
A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README/JSON/SARIF/doc/PDF.
43 GitHub stars (43)
+4 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | +1 |
| Oct 5 | 0 |
| Oct 6 | +1 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | +1 |
| Oct 14 | 0 |
| Oct 15 | +1 |
| Oct 16 | 0 |
- 18 skills (18 skills found in its SKILL.md files)
- 11 forks (11 forks)
- 1d ago last update (Last updated 1d ago)
Install
Skills CLI
npx skills add dmdhrumilmistry/security-harness
Asks which skills and agents to install. Just one: npx skills add dmdhrumilmistry/security-harness --skill sh-kb-access-control — add -g for every project.
Claude Code
git clone https://github.com/dmdhrumilmistry/security-harnesscp -r "security-harness/skills/sh-kb-access-control" ~/.claude/skills/
Copies the sh-kb-access-control skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add dmdhrumilmistry/security-harness
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md — showing the first 18 of 36 files.
-
sh-kb-access-control
Knowledge base for finding broken access control - IDOR/BOLA, missing function-level authorization, privilege escalation, and multi-tenant isolation failures. Use when hunting authorization issues or reviewing whether users can access resources/actions they shouldn't. CWE-284/285/639/862/863, OWASP A01:2021-Broken Access Control.
skills/sh-kb-access-control/SKILL.md on GitHub (opens in a new tab) -
sh-kb-auth
Knowledge base for finding authentication and session-management failures - weak login, broken JWT/session handling, password/reset flaws, MFA bypass, credential storage issues. Use when hunting authentication (not authorization - see sh-kb-access-control). CWE-287/384/613/620/640, OWASP A07:2021-Identification and Authentication Failures.
skills/sh-kb-auth/SKILL.md on GitHub (opens in a new tab) -
sh-kb-crypto
Knowledge base for finding cryptographic failures - weak hashing/encryption, insecure randomness, hardcoded/static keys and IVs, ECB mode, missing integrity, and predictable tokens. Use when hunting crypto misuse. CWE-327/328/330/326/916, OWASP A02:2021-Cryptographic Failures.
skills/sh-kb-crypto/SKILL.md on GitHub (opens in a new tab) -
sh-kb-csrf
Knowledge base for finding Cross-Site Request Forgery - state-changing requests that rely only on ambient credentials (cookies) with no anti-CSRF token or SameSite protection. Use when hunting CSRF. CWE-352, OWASP A01:2021-Broken Access Control.
skills/sh-kb-csrf/SKILL.md on GitHub (opens in a new tab) -
sh-kb-deserialization
Knowledge base for finding insecure deserialization - untrusted data fed to object-deserialization APIs that can trigger RCE or object injection via gadget chains. Use when hunting deserialization issues. CWE-502, OWASP A08:2021-Software and Data Integrity Failures.
skills/sh-kb-deserialization/SKILL.md on GitHub (opens in a new tab) -
sh-kb-file-upload
Knowledge base for finding unrestricted/insecure file upload - uploads that allow dangerous file types, execution in the upload dir, path control over the stored name, or missing content validation, leading to RCE, XSS, or overwrite. Use when hunting file-upload issues. CWE-434/436/616, OWASP A04/A05:2021.
skills/sh-kb-file-upload/SKILL.md on GitHub (opens in a new tab) -
sh-kb-injection
Knowledge base for finding command/OS injection, template injection (SSTI), code injection (eval), and LDAP/NoSQL/expression injection. Use when hunting injection into shells, template engines, interpreters, or directory queries. CWE-77/78/94/917, OWASP A03:2021-Injection.
skills/sh-kb-injection/SKILL.md on GitHub (opens in a new tab) -
sh-kb-open-redirect
Knowledge base for finding open/unvalidated redirects - user-controlled redirect targets that send victims to attacker sites, enabling phishing, token leakage, and OAuth/SSO abuse. Use when hunting open redirects. CWE-601, OWASP A01:2021-Broken Access Control.
skills/sh-kb-open-redirect/SKILL.md on GitHub (opens in a new tab) -
sh-kb-path-traversal
Knowledge base for finding path/directory traversal and local/remote file inclusion - user-controlled paths reaching filesystem or include operations, enabling arbitrary file read/write or code inclusion. Use when hunting traversal/LFI/RFI. CWE-22/23/98, OWASP A01:2021-Broken Access Control.
skills/sh-kb-path-traversal/SKILL.md on GitHub (opens in a new tab) -
sh-kb-race-conditions
Knowledge base for finding race conditions and TOCTOU flaws - concurrent requests exploiting non-atomic check-then-act logic (double-spend, limit bypass, balance manipulation, file TOCTOU). Use when hunting concurrency/business-logic race bugs. CWE-362/367/366, OWASP A04:2021-Insecure Design.
skills/sh-kb-race-conditions/SKILL.md on GitHub (opens in a new tab) -
sh-kb-secrets
Knowledge base for finding hardcoded secrets and sensitive-data exposure - API keys, passwords, tokens, private keys, and connection strings embedded in source/config, or secrets leaked to logs/errors/URLs. Use when hunting secret exposure. CWE-798/259/312/532, OWASP A05/A02:2021.
skills/sh-kb-secrets/SKILL.md on GitHub (opens in a new tab) -
sh-kb-sqli
Knowledge base for finding SQL injection (and query-language injection). Use when hunting SQLi, or when a hunter/reviewer needs sources, sinks, detection queries, payloads, false-positive filters, and remediation for injection into SQL/ORM raw queries. CWE-89, OWASP A03:2021-Injection.
skills/sh-kb-sqli/SKILL.md on GitHub (opens in a new tab) -
sh-kb-ssrf
Knowledge base for finding Server-Side Request Forgery - when the server makes outbound requests to attacker-controlled destinations. Use when hunting SSRF or reviewing URL/host inputs that reach HTTP/network clients. CWE-918, OWASP A10:2021-SSRF.
skills/sh-kb-ssrf/SKILL.md on GitHub (opens in a new tab) -
sh-kb-xss
Knowledge base for finding Cross-Site Scripting - reflected, stored, and DOM-based XSS. Use when hunting XSS or reviewing untrusted data rendered into HTML/JS/attributes without context-correct encoding. CWE-79, OWASP A03:2021-Injection.
skills/sh-kb-xss/SKILL.md on GitHub (opens in a new tab) -
sh-kb-xxe
Knowledge base for finding XML External Entity injection - XML parsers configured to resolve external/general entities on untrusted input, enabling file read, SSRF, and DoS. Use when hunting XXE. CWE-611/776/827, OWASP A05:2021-Security Misconfiguration.
skills/sh-kb-xxe/SKILL.md on GitHub (opens in a new tab) -
sh-pr-review
Security-review a GitHub pull request, post the result as inline review comments on the PR, and set a pass/fail commit status that branch protection can enforce. Fails the PR for vulnerabilities it introduces or makes worse; passes with a warning for pre-existing ones. Triages the diff first and scales depth to risk, dedupes across re-pushes, and never posts without an explicit yes. Use when revi…
skills/sh-pr-review/SKILL.md on GitHub (opens in a new tab) -
sh-router
Entry point / dispatcher for the security-harness. Use when the user asks for any application-security work - 'security review', 'audit this codebase', 'pentest', 'find vulnerabilities', 'check for SQLi/XSS/IDOR/SSRF', 'generate a security report/SARIF'. Interprets the request and routes it to the full sh-security-review pipeline, a single stage, or a single vulnerability-class knowledge base.
skills/sh-router/SKILL.md on GitHub (opens in a new tab) -
sh-security-review
Run the full multi-agent security review pipeline on a codebase - recon/mapping (Graft + SBOM/CVE), parallel vulnerability hunting backed by ~15 per-class knowledge bases, escalation chaining, impact verification, and reporting to README/JSON/SARIF/doc/PDF. Use when the user asks to security-review, audit, pentest, or find vulnerabilities in a codebase. Usually invoked via the sh-router skill.
skills/sh-security-review/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.
Similar skills
-
ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
-
marketingskillsby coreyhaines31 Marketing skills for Claude Code and AI agents. CRO, copywriting, SEO, analytics, and growth engineering.
-
autoharnessby tigerless-labs Autoharness — a self-learning skill layer for Claude Code — distills skills from your real sessions, updates them as you work, and prunes t…
-
notfair-pluginby nowork-studio Open-source SEO, GEO, and marketing skills for AI agents.
-
scroll-craftby nateherkai An agent skill for building premium, immersive, scroll-driven websites. Works with Codex, Claude Code, and other coding agents. Also availa…
-
reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries.