defensive-grc-audit-evidence

Use when testing a web application for SQL injection on an authorized engagement.

7 skills

Use when planning or running nmap scans during authorized engagements: host discovery options, TCP SYN, connect, UDP, NULL, FIN, Xmas, and ACK scan types, service and OS detection, timing templates T0 to T5, evasion techniques (fragmentation, decoys, idle scans, source port tricks, data length padding), NSE script selection by category, and output formats for evidence.

6 skills

Use when you hold a low-privilege Linux shell on an authorized engagement, lab, or CTF and need a reliable path to root.

6 skills

Use when testing a web application for cross-site scripting on an authorized engagement.

6 skills

Use when mapping an authorized Active Directory environment during an internal assessment or assumed breach exercise.

5 skills

Use when testing REST, GraphQL, or internal APIs on an authorized engagement.

5 skills

Design fluency for frontend development. 1 skill with 24 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.

1 skill · 4 agents · hooks

Tenant-isolated AI teams that plan work, coordinate tasks, recall approved context, and return evidence-backed results

6 skills · 6 commands · 4 agents · 1 MCP server

5 skills + 35 modes + Material Passport pipeline. Includes v3.6.7 cross-model audit gate and v3.6.8 generator-evaluator contract.

5 skills · 16 commands · 4 agents · hooks

Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.

1 skill · 9 agents · hooks

Independent auditing for AI agents, open source. Claude discovers your setup, confirms the cost, and audits your agent against the one question other tools skip: is it doing the job it's supposed to do, given your business rules and org structure? Test any model (Anthropic, OpenAI, Gemini, Azure, Bedrock, …) graded by self, one independent judge, or a cross-vendor panel; each provider is billed to its own account via a key in your settings, never the command line. Results render as an interactive artifact (with a static-report fallback).

1 skill · hooks

Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security

4 skills · 3 agents