velimattiv
UserA thorough, polyglot, multi-phase security audit skill for Claude Code. Discovers attack surfaces across 60+ frameworks, runs a SARIF scanner bundle, executes 9 parallel deep-dive categories, and produces an OWASP-methodology-tagged report.
Categories
Indexed Skills (2)
security-audit
Comprehensive polyglot security audit across 60+ frameworks. Runs a SARIF scanner bundle, fans out 11 parallel deep-dive categories (incl. supply-chain and MCP/agentic), and emits an OWASP-methodology-tagged report. Invoke when the user says 'run security audit', 'security audit', 'audit security', or passes args like 'mode: delta' / 'scope: services/api' / 'categories: crypto,mitm,secrets' / 'output: docs/security-audit-output'. Typical run 15-60 min (full) or 2-5 min (delta). MANDATORY ARTIFACT CONTRACT: every run MUST write (1) .claude-audit/current/ as your FIRST tool action via mkdir -p; (2) per-phase phase-NN-*.json AND a phase-NN.done marker for each completed phase 0-7 (8 if mode=full) BEFORE moving to the next phase; (3) findings.sarif (SARIF 2.1.0) where EVERY results[] row carries properties.security-severity (CVSS-style numeric) AND properties.cwe (e.g. 'CWE-798' — required for downstream tooling, lookup in lib/cwe-map.json) AND optionally properties.category (one of: auth, idor, token_scope, mitm
bmad-review-adversarial-general
Perform a Cynical Review and produce a findings report. Use when the user requests a critical review of something
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.