AppSec review suite: multi-language security-reviewer (8-point check, 7 language packs, OWASP/ASVS + endpoint checklists), whole-repo security-assessment, diff-scoped 0day-scanner, STRIDE/DREAD threat-modeling, and two threat-model-driven tiers (tm-quick-security-assessment, tm-security-review). Ships 4 slash commands, a security-reviewer subagent, and 3 opt-in hooks.
Plugin phoenix-security-review from marketplace phoenix-security in Security-Phoenix-demo/security-skills-claude-code. Commands read from the repo's manifest — 1 month ago.
0day-scannerLLM-powered zero-day vulnerability analysis of code changes — a commit, a pull request, a file or a branch — in light, standard or deep mode, with cost budgeting and knowledge-graph linking. Use whenever someone asks to scan for vulnerabilities, check for security issues, mentions 0-day or zero-day,
security-assessmentComprehensive OWASP Top 10 2025 and ASVS Level 1 security assessment across a whole codebase, with cost budgeting, knowledge-graph linking and automated test generation. Use whenever someone asks to run a security assessment, a security audit, a security check or a vulnerability assessment; mentions
security-reviewerMulti-language security review for web apps, APIs, and CLIs. Use whenever code is added or modified — new endpoints, auth/RBAC changes, template or DOM rendering, outbound HTTP, dependency updates, IaC/config changes, or end-of-feature reviews. Covers Python, JavaScript, TypeScript, Go, Rust, Java/K
threat-modelingAutomated STRIDE and DREAD threat modelling from code analysis. Extracts architecture, data flows, entry points and trust boundaries, then produces ranked threats, attack scenarios, mitigations and compliance-ready documentation. Use for security assessment, architecture review, compliance documenta
tm-quick-security-assessmentThe QUICK tier. Scope to a git worktree/branch and assess only what changed against a base — a fast, threat-model-aware pre-merge security pass (attack-surface delta + OWASP Top 10 on changed files) with the trust-direction gate applied. Composes the security-assessment + 0day-scanner (light) skills
tm-security-reviewThe COMPREHENSIVE tier. Build (or ingest) a full STRIDE threat model as input, then run a sophisticated whole-repo adversarial zeroday exploit review (triple-pass HUNT -> JUDGE -> VERIFY) that validates the model against the code and proves a runnable PoC per confirmed finding. Composes the threat-m
/phoenix-security-review:security-0dayScan the current branch's diff (vs main) for 0-day-style vulnerabilities. Light, fast, PR-focused.
/phoenix-security-review:security-auditFull OWASP Top 10 + ASVS L1 security assessment of the codebase. Slow + thorough.
/phoenix-security-review:security-reviewMulti-language security review (8-point check) on recent changes. Routes to the bundled stronger reviewer when present, falls back to the lite reviewer otherwise.
/phoenix-security-review:threatmodelGenerate a STRIDE/DREAD threat model for the repository, a feature, or a component.
security-reviewerMulti-language AppSec review subagent. Use proactively when adding endpoints, modifying auth/RBAC, rendering dynamic content, handling outbound HTTP, updating dependencies, or completing a major feature. Reads the `security-reviewer` skill (`.claude/skills/security-reviewer/SKILL.md`) for its 8-poin
Security-first specification pipeline. prd-generator writes a full PRD with a threat model from a plain-language feature description. The 12 phoenix-* roles run the same pipeline stage by stage: context curation, scope, constraints, RFC 2119 requirements, ambiguity hunting, threat model, API contracts, verification matrix, delivery batches and a final ship gate.
13 skills
Documentation and research tooling. project-documenter generates and self-heals a full documentation pack across 6 modes. notebooklm queries Google NotebookLM for citation-backed, source-grounded answers. phoenix-research-pipeline runs web and YouTube research and pushes sources into NotebookLM.
3 skills
Cyber threat intelligence search across 595 curated security domains in 4 authority tiers, for CVEs, threat actors, malware families, exploits and breach reports. Ships a skill that needs no API key, a Node CLI, an MCP server, and a /cti-search command. Optional push to NotebookLM.
1 skill · 1 command
Two adversarial review gates. plan-readiness-review asks whether a PRD, spec or RFC is implementable without inventing anything. production-readiness-review asks whether the code is actually built, wired, tested and safe to deploy, backed by a deterministic repo scanner.
2 skills
Generate opengrep/semgrep SAST rules for 30+ languages, including pattern and taint-mode rules. The research variant first researches a CVE or CWE with web search, then writes targeted detection rules from the findings.
2 skills
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.