Updated 2w ago
by kulchankas
paranoid
Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.
48 GitHub stars (48)
+6 in 18 days
| Period | New stars |
|---|---|
| Sep 29 | 0 |
| Sep 30 | +1 |
| Oct 1 | +5 |
| Oct 2 | +1 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | −1 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | 0 |
| Oct 15 | 0 |
| Oct 16 | 0 |
- 1 skill (1 skills found in its SKILL.md files)
- 3 forks (3 forks)
- 2w ago last update (Last updated 2w ago)
Install
Skills CLI
npx skills add kulchankas/paranoid
Asks which agents to install it for. Add -g to install it for every project.
Claude Code
git clone https://github.com/kulchankas/paranoidcp -r "paranoid/skills/paranoid" ~/.claude/skills/
Copies the paranoid skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).
Plugin
/plugin marketplace add kulchankas/paranoid
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
paranoid
Write and review code as if it gets pentested tomorrow. Load this whenever code touches a trust boundary: authentication, authorization, user input, database access, secrets or environment variables, file uploads, outbound requests (fetch/webhooks), API or webhook endpoints, or anything that runs raw SQL/shell/HTML. Also load it when the user asks to security-review, harden, or "hack"/pentest the…
skills/paranoid/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.