Did a PR, commit or commit range break something that used to work? Pins the before and after states, hunts candidate regressions in the diff, then has three separate fresh agents reproduce, replay and adjudicate each one on live S0 and S1 builds. Sealed evidence, an attempt registry and an HTML/Markdown/JSON report stay in a campaign directory outside the repo; GitHub is only read.
Plugin regression-hunt from marketplace devops in flyoverhead/devops-plugins. Commands read from the repo's manifest — today.
adjudicate-regressionDecides one candidate from sealed evidence — source, setup, PoC, raw S0/S1 logs and the project's security promises — as REPRODUCED_REGRESSION, INCOMPLETE_FIX, LATENT_BUG, PREEXISTING_BUG, REJECTED or UNRESOLVED, with category, severity, likelihood and nine cited checks for a confirmation, in a seal
hunt-regressionsReads the whole frozen diff of one change, traces every changed behaviour through its callers to a real interface, and writes one sealed candidate file per plausible regression lead with a stable hypothesis key reserved through registry.py, plus hunt.json with coverage and limits — no PoCs, no build
prepare-regressionPins the before (S0) and after (S1) commits of one change for a regression campaign — single commit, explicit range, open PR, merge, squash or rebased landing — freezes the PR text, comments or commit messages with collection time, exports both trees with snapshot.py, looks for security docs on both
regression-huntRuns a regression campaign on a GitHub PR, a commit or a commit range — pins before (S0) and after (S1), hunts candidates in the diff, and has three separate fresh agents reproduce, replay and adjudicate each one on live S0 and S1 builds, with sealed evidence and a report outside the repo. Use when
replay-regressionReplays a sealed reproduction independently — verifies the package, rebuilds S0 and S1 from the pinned exports in its own attempt directory, runs the byte-identical PoC and workload with only the attacker or user access the candidate claims, and records any divergence in a sealed replay.json. Use as
report-regressionsReconciles a regression campaign's index with its frozen scope, assigned changes and accepted candidates, renders index.html, report.md and report.json with report.py into its own attempt directory, checks the counts and links, and seals report-stage.json — blocked on any integrity failure, never re
reproduce-regressionBuilds copies of the pinned S0 and S1 exports inside its own attempt directory, deploys both locally, and runs one portable PoC with identical input against each through a real interface, keeping setup, PoC, workload, separate logs and the observed behaviour (correct, failure, unknown) in a sealed r
Go toolkit: version-aware idioms, concurrency fixes proven with the race detector, performance work backed by benchmarks and profiles, read-only code review, tests that match the repository, a GitHub-ready project scaffold and gopls LSP.
5 skills · 3 agents · hooks · LSP
Ansible toolkit: role creator in the classic upstream layout (install/configure/service, meta/argument_specs.yml, sentence-case names, true/false, FQCN, ansible-lint production profile), role checker and molecule scaffolder, plus a guard on real ansible-playbook runs
3 skills · 1 agent · hooks
One reported bug, reproduced on the unchanged build, re-run blind by a second agent, fixed at its invariant with a failing-first regression test and a single signed-off local commit, then proven on baseline, patched and reverted worktrees by yet another agent. Records, receipts and hash manifests stay in $TMPDIR; nothing is pushed.
5 skills
Terraform toolkit: module-creator for YAML-driven modules with inheritance and validation layers (OpenStack, VMware, AWS, Azure, GCP, Proxmox), provider-creator for Plugin Framework providers with a GitHub Actions release, plus terraform-ls LSP and safety hooks
2 skills · 1 agent · hooks · LSP
Settles whether suspected security findings tied to a code location are real: restates each claim, traces source to sink, proves or refutes attacker control and impact, writes PoCs outside the repo without running them, and passes six gates before a TRUE or FALSE POSITIVE verdict. Takes scanner output, review findings or a pasted GitHub code-scanning alert.
1 skill · 3 agents
API design and review: OpenAPI 3.1 specs, REST and GraphQL patterns, OWASP API Security Top 10 review with Spectral and Redocly linting
1 skill · 1 agent · hooks
Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
Tenant-isolated AI teams that plan work, coordinate tasks, recall approved context, and return evidence-backed results
6 skills · 6 commands · 4 agents · 1 MCP server
Install the "AAS Security Engineer" editorial skill bundle for Claude Code.
12 skills
SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.
200 skills
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.