sechelix

Plugin sechelix from marketplace sechelix in omarmohelal2/sechelix-marketplace. Commands read from the repo's manifest — 1 month ago.

Skills (2)

• sechelix

  Portable evidence-first application-security audit workflow for authorized systems. Use to review codebases, APIs, web apps, auth/authz, business logic, races, payments, supply chain, AI/MCP integrations, cloud/config, and releases. Also use for requested SEO audits and safe codebase cleanup via the

• sechelix-lite

  Evidence-first application-security review for codebases, pull requests and environments the user is authorized to assess. Use when asked to security-review a repository or diff, audit authentication, authorization (IDOR/BOLA/BFLA), business logic, race conditions, injection, SSRF, file handling, su

Subagents (17)

• ai-mcp-agent-security-reviewer

  Review agent identity, prompt/tool boundaries, MCP authorization, untrusted context, tool output and automatic side effects. Produce candidates only.

• authentication-reviewer

  Review authentication, sessions, account recovery, MFA/step-up, cookies, tokens and federation. Produce candidates only.

• authorization-bola-bfla-reviewer

  Review object and function authorization, roles, capabilities, BOLA/BFLA, tenant isolation and fail-open permission paths. Produce candidates only.

• browser-extension-reviewer

  Review browser/client boundaries, DOM/origin behavior, extension privileges, messaging, storage and browser-only build/runtime exposure. Produce candidates only.

• business-logic-reviewer

  Review workflow, entitlement, inventory, approval and state-machine abuse outside payment-specific accounting. Produce candidates only.

• ci-cd-cloud-reviewer

  Review CI identities, workflow trust, secrets, artifacts, deployments, cloud policy and runtime configuration. Produce candidates only.

• database-rls-migrations-reviewer

  Review database authorization, RLS, grants, functions, constraints, migrations and rollback safety. Produce candidates only.

• independent-verifier

  Independently reconstruct and try to refute candidate security findings without assuming the claim or proposed severity is correct.

• injection-web-reviewer

  Review SQL, command, template, HTML/DOM and expression injection plus XSS, CSRF, redirects and web security controls. Produce candidates only.

• surface-mapper

  Map architecture, identities, assets, entrypoints, data flows and trust boundaries from repository evidence. Produce a map and candidate hypotheses, never final vulnerabilities.

• payments-accounting-reviewer

  Review money, prices, currencies, refunds, payouts, settlement, ledger and reconciliation invariants. Produce candidates only.

• privacy-logging-reviewer

  Review collection, minimization, logging, telemetry, redaction, retention and privacy-sensitive data flows. Produce candidates only.

• race-idempotency-reviewer

  Review concurrency, retries, duplicate callbacks, TOCTOU, process crash and exact-once/idempotency controls. Produce candidates only.

• regression-release-verifier

  Verify behavioral regression proof, neighboring controls and release-readiness evidence after remediation without substituting scanner output for proof.

• remediation-reviewer

  Review verified root causes and design canonical, compatibility-aware remediations with explicit preservation and regression requirements.

• ssrf-file-parser-reviewer

  Review outbound requests, URL validation, uploads, filesystem paths, archives and document/media/parser boundaries. Produce candidates only.

• supply-chain-reviewer

  Review dependencies, packages, lockfiles, install/build inputs, provenance and artifact integrity. Produce candidates only.

Similar plugins