deep-security-auditlisted

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app/repo", or review auth / SSRF / IDOR / injection / secrets. READ-ONLY by default — never edits, commits, or exploits live systems.
ravindrakele/claude-skills · ★ 3 · Data & Documents · score 71

Install: claude install-skill ravindrakele/claude-skills

# Deep Security Audit A repeatable, multi-agent pipeline that finds real, exploitable security bugs by **understanding code**, not pattern-matching. It fans work out to scoped finder agents, then makes a second wave of agents **try to refute** each finding before it's reported — so what survives is high-signal. ## Operating rules (non-negotiable) 1. **READ-ONLY.** Static analysis of source only. Never edit/commit/push. Never run an exploit against a live/hosted system. Local, self-owned, non-destructive PoCs only — and only if the user explicitly asks to verify one. 2. **Understand, don't grep.** grep is for *locating* the surface. Every finding must come from an agent that read the handler, its callers, its auth/middleware/validation, and traced reachability. No finding from a raw grep hit alone. 3. **Prove the guard is ABSENT.** A missing check is only a finding if you verified the framework's normal guard (nonce, capability, policy, `permission_callback`, auth middleware, `prepare()`, escaping, validation) is genuinely not there on that path. Frameworks have defaults — check them. 4. **Honest CVSS, no inflation.** Score CVSS 3.1 by real preconditions. If a BOLA needs an unguessable UUID → `AC:H`. If exploitation needs auth → `PR:L/H`. State the precondition. Downgrade the moment evidence contradicts the ceiling. 5. **Empirically calibrate when possible.** If a "read-back / exfil" claim can be safely checked locally and the data doesn't a