claude

sechelix

Evidence-first application-security Agent Skill for authorized repositories and environments. Maps attack surfaces, selects applicable security hypotheses, independently verifies material findings, fixes root causes, requires regression proof, and produces explicit release decisions.

1 on GitHubby SecHelixv4.0.0-alpha.7Apache-2.0updated 14 days ago

Not in a marketplace yet, so it loads for one session with --plugin-dir.

Plugin sechelix in omarmohelal/SecHelix. Commands read from the repo's manifest — 12 days ago.

What it installs

Skills (2)

  • sechelix

    Portable evidence-first application-security audit workflow for authorized systems. Use to review codebases, APIs, web apps, auth/authz, business logic, races, payments, supply chain, AI/MCP integrations, cloud/config, and releases. Also use for requested SEO audits and safe codebase cleanup via the

  • sechelix-lite

    Evidence-first application-security review for codebases, pull requests and environments the user is authorized to assess. Use when asked to security-review a repository or diff, audit authentication, authorization (IDOR/BOLA/BFLA), business logic, race conditions, injection, SSRF, file handling, su

Subagents (17)

  • ai-mcp-agent-security-reviewer

    Review agent identity, prompt/tool boundaries, MCP authorization, untrusted context, tool output and automatic side effects. Produce candidates only.

  • authentication-reviewer

    Review authentication, sessions, account recovery, MFA/step-up, cookies, tokens and federation. Produce candidates only.

  • authorization-bola-bfla-reviewer

    Review object and function authorization, roles, capabilities, BOLA/BFLA, tenant isolation and fail-open permission paths. Produce candidates only.

  • browser-extension-reviewer

    Review browser/client boundaries, DOM/origin behavior, extension privileges, messaging, storage and browser-only build/runtime exposure. Produce candidates only.

  • business-logic-reviewer

    Review workflow, entitlement, inventory, approval and state-machine abuse outside payment-specific accounting. Produce candidates only.

  • ci-cd-cloud-reviewer

    Review CI identities, workflow trust, secrets, artifacts, deployments, cloud policy and runtime configuration. Produce candidates only.

  • database-rls-migrations-reviewer

    Review database authorization, RLS, grants, functions, constraints, migrations and rollback safety. Produce candidates only.

  • independent-verifier

    Independently reconstruct and try to refute candidate security findings without assuming the claim or proposed severity is correct.

  • injection-web-reviewer

    Review SQL, command, template, HTML/DOM and expression injection plus XSS, CSRF, redirects and web security controls. Produce candidates only.

  • surface-mapper

    Map architecture, identities, assets, entrypoints, data flows and trust boundaries from repository evidence. Produce a map and candidate hypotheses, never final vulnerabilities.

  • payments-accounting-reviewer

    Review money, prices, currencies, refunds, payouts, settlement, ledger and reconciliation invariants. Produce candidates only.

  • privacy-logging-reviewer

    Review collection, minimization, logging, telemetry, redaction, retention and privacy-sensitive data flows. Produce candidates only.

  • race-idempotency-reviewer

    Review concurrency, retries, duplicate callbacks, TOCTOU, process crash and exact-once/idempotency controls. Produce candidates only.

  • regression-release-verifier

    Verify behavioral regression proof, neighboring controls and release-readiness evidence after remediation without substituting scanner output for proof.

  • remediation-reviewer

    Review verified root causes and design canonical, compatibility-aware remediations with explicit preservation and regression requirements.

  • ssrf-file-parser-reviewer

    Review outbound requests, URL validation, uploads, filesystem paths, archives and document/media/parser boundaries. Produce candidates only.

  • supply-chain-reviewer

    Review dependencies, packages, lockfiles, install/build inputs, provenance and artifact integrity. Produce candidates only.

View source on GitHub sechelix.com

Similar plugins

ruflo-rure

claude

Statically analyze a local JS/Electron app you're authorized to study, with file+line evidence, and build an original reimplementation of what you find. Experimental. Phase 1: JS/Electron static analysis. Phase 2: native ELF/PE/Mach-O container inspection. Phase 3: .NET assembly metadata. Phase 4: EVM bytecode inventory. Phase 5: CUDA fatbin, cubin and PTX inventory. Parses, never executes. Dynamic analysis is a future phase, not yet implemented.

1 skill · 1 command · 1 agent

ruvnet/ruflo 81,589

agentic-bundle-skill-author

claudecodex

Install the "Skill Author" editorial skill bundle for Claude Code.

6 skills

sickn33/agentic-awesome-skills 49,620

data

claude

Data engineering for Apache Airflow and Astronomer. Author DAGs with best practices, debug pipeline failures, trace data lineage, profile tables, migrate Airflow 2 to 3, and manage local and cloud deployments.

35 skills · hooks

anthropics/claude-plugins-official 47,076

reverse-engineering

claudecodex

Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security

4 skills · 3 agents

wshobson/agents 42,461

Sanity

claudecodex

Sanity content platform integration with MCP server, agent skills, and slash commands. Query and author content, build and optimize GROQ queries, design schemas, and set up Visual Editing.

8 skills · 4 commands · 1 MCP server

anthropics/knowledge-work-plugins 35,601

engineering-advanced-skills

claude

45 advanced engineering skills: agent designer, agent workflow designer, RAG architect, database designer + schema designer + SQL assistant, migration architect, observability designer, dependency auditor, changelog generator, API design reviewer, API test suite builder, CI/CD pipeline builder, MCP server builder, skill security auditor, skill tester, performance profiler, focused-fix, browser-automation, full-page-screenshot, git-worktree-manager, monorepo-navigator, codebase-onboarding, interview-system-designer, runbook-generator, spec-driven-workflow, secrets-vault-manager, env-secrets-manager, pr-review-expert, self-eval, tc-tracker, feature-flags-architect, kubernetes-operator, chaos-engineering, ship-gate, slo-architect (error-budget + multi-window burn-rate alerts per Google SRE Workbook), tech-debt-tracker, agent-regression-evals, coding-agent-rollout, commit-craft, agent-run-forensics and i18n-localization. Agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw.

48 skills · hooks

alirezarezvani/claude-skills 29,725

Maintain sechelix?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex pluginslisted