backend-security-skill

Project overview

Repo Forensics scans untrusted agent repositories locally for prompt injection, malicious packages, MCP tool poisoning, credential access, data exfiltration, obfuscated execution, and compound attack chains. It can audit an existing agent stack or install hooks that block known package indicators before commands and run a broader review after clones or installs. Detection rules and vulnerability intelligence can be updated separately, and the scanner reports no telemetry.

Project overview

security-audit guides Claude Code through a defensive review of a codebase, an authorized black-box target, or both. It selects the appropriate checklist for authentication, injection, SSRF, file handling, infrastructure exposure, and rate-limit posture, then emphasizes verification and coordinated disclosure. The runbook assumes explicit permission for external probing and is not a substitute for a funded penetration test or a guide for unauthorized targeting.