odin-security

Plugin odin-security from marketplace odin-marketplace in OutlineDriven/odin-claude-plugin. Commands read from the repo's manifest — 1 month ago.

Skills (31)

• burpsuite-project-parser

  Use when asked to analyze a Burp Suite .burp project for audit items, request/response metadata, or captured traffic. Modes: parsed (default) and stream. Not for source or remote-system changes.

• c-security-review

  Use when the user requests a userspace C or C++ security review with a threat model and severity filter and wants validated findings. Not for kernel or bare-metal code: use kernel-security.

• chain-vulnerability-scanner

  Use when an Algorand, Cairo, Cosmos SDK, Solana, Substrate, or TON codebase needs vulnerability scanning with reachability-backed findings. Not for non-chain review: use security-review.

• codeql-security-analysis

  Use when building or reusing a CodeQL database, running CodeQL security analysis, or modeling project-specific sources and sinks. Not for manual vulnerability review: use security-review (mode: confirmed).

• constant-time-analysis

  Use when reviewing cryptographic code for timing side-channels, statically in compiled output or at runtime with statistical timing tests. Not for known-answer vectors: use wycheproof.

• crypto-protocol-diagram

  Use when asked for a sequence diagram of cryptographic protocol semantics from code, prose, RFCs, papers, ProVerif, or Tamarin, or for code/spec divergence. Not for architecture: use diagramming-code.

• django-access-review

  Use when reviewing Django or DRF access control, IDOR, authorization, permissions, or tenant isolation. Not for Django query performance: use django-perf-review. No source or remote-system changes.

• firebase-apk-scanner

  Use when an authorized user needs to assess mobile-backend exposure from compiled Android APKs, covering Firebase, custom HTTP backends, and cloud function endpoints. Human-only invocation.

• function-audit-context-analyzer

  Use when asked for audit-context analysis of one function, or to build audit context across codebase before vulnerability hunting. Local write only. Not for vulnerability finding or severity rating.

• gha-security-review

  Use when asked to review GitHub Actions for exploitable vulnerabilities, including prompt injection through Claude Code Action, Gemini CLI, or OpenAI Codex. Read-only. Not for general security review.

• insecure-default-discovery

  Use when the user asks to audit a file, subtree, or repository for fallback secrets, default credentials, fail-open controls, weak primitives, or permissive access. Not for exhaustive secret scanning.

• mermaid-to-proverif

  Use when a crypto Mermaid sequenceDiagram needs a ProVerif model for secrecy, authentication, replay, or forward-secrecy checks. Not for remote, credential, publish, deploy, or irreversible changes.

• oauth2-flow-implementation

  Use when asked to implement, debug, validate, or explain an OAuth 2.1 flow: auth code with PKCE, client credentials, device, or refresh. Also for a failing token exchange. Not for irreversible work.

• project-findings-onto-graph

  Use when graph-backed security analysis is needed: project SARIF or reviewer findings onto a program graph; build or query a multi-language graph; summarize Trailmark structure; map smart-contract entry points; compare two refs or snapshots; or hunt confirmed vulnerability variants with pattern or g

• rust-security-review

  Use when asked for a Rust security or correctness audit of a crate, service, or library with unsafe, FFI, concurrency, async, or untrusted-input code. Not for general review: use security-review.

• security-finding-verification

  Use when a named security allegation needs a true-positive or false-positive verdict. Not for discovering bugs: use security-review. Not for adding controls: use security-hardening.

• security-hardening

  Use when adding security controls for untrusted input, auth/authz, data storage, or external integrations. Not for audit: use security-review. Not for finding: use security-finding-verification.

• security-review

  Use when changes touch auth, parsing, dependencies, network, or pre-release, or a diff or baseline needs regression review, or the user asks for a security review, vulnerability audit, or OWASP review of a supplied file, diff, or component, covering injection, XSS, auth, or crypto, with high-confide

• semgrep-rule-authoring

  Use when a vulnerability or pattern and target language need a new Semgrep rule, or an existing rule needs porting to another language. Not for running scans: use semgrep-security-scan.

• semgrep-security-scan

  Use when a user asks for a Semgrep security scan or fast pattern-based scan of a codebase. Not for authoring or porting rules: use semgrep-rule-authoring.

• smart-contract-audit-prep

  Use when a smart-contract project must become review-ready before an audit. Not for workflow: use smart-contract-secure-workflow. Not for guidelines: use smart-contract-guidelines-advisor.

• smart-contract-guidelines-advisor

  Use when a smart-contract project needs architecture, testing, or a maturity scorecard. Use `guidelines` or `maturity` mode. Not for audits: use smart-contract-audit-prep.

• smart-contract-secure-workflow

  Use when a smart-contract team invokes this before check-in or deployment. Not for audit prep: use smart-contract-audit-prep. Not for guidelines: use smart-contract-guidelines-advisor.

• supply-chain-risk-auditor

  Use when assessing npm, PyPI, or Go dependency supply-chain risk, with lockfile-absent paths marked unassessable. Not for remote or irreversible changes.

• token-integration-analyzer

  Use when a token implementation or integration needs standards, privilege, nonstandard-behavior, and defensive-integration analysis. Not for source or remote-system changes.

• triage-security-finding

  Use when exactly one concrete security finding with a source anchor needs a verdict before PoC work. Not for projecting batches of findings onto a graph: use project-findings-onto-graph.

• vector-forge

  Use when crypto implementations and a vector harness need mutation-driven cross-implementation test vector expansion. Not for Wycheproof: use wycheproof. Not for fuzzing: use fuzz-harness-writing.

• vulnerability-triage-brocards

  Use when a vulnerability report, CVE, bug-bounty submission, or automated finding needs triage before deep verification. Don''t use for tasks that require source or remote-system changes.

• wycheproof

  Use when validating crypto against Project Wycheproof vectors, or explaining a disagreement with a vector. Not for vector creation: use vector-forge. Not for zeroization: use zeroize-audit.

• yara-rule-authoring

  Use when writing, reviewing, optimizing, validating, or migrating YARA or YARA-X malware-detection rules, including CRX or DEX rules. Not for network IDS or memory-forensics rules.

• zeroize-audit

  Use when auditing C, C++, or Rust secret-handling code to verify zeroization survives compiler optimization. Not for test vectors: use wycheproof.

Similar plugins