repo-forensics

Use the skill in audit, scan, guide, or harden mode to review a backend project. It detects the stack, maps the attack surface, traces untrusted input to dangerous sinks, checks dependencies and configuration, and reports verified findings with file locations, severity, and fix guidance. Its coverage is anchored to OWASP and ASVS, but it is not runtime testing, a professional penetration test, or a compliance program, and it does not edit code without approval.

security-audit guides Claude Code through a defensive review of a codebase, an authorized black-box target, or both. It selects the appropriate checklist for authentication, injection, SSRF, file handling, infrastructure exposure, and rate-limit posture, then emphasizes verification and coordinated disclosure. The runbook assumes explicit permission for external probing and is not a substitute for a funded penetration test or a guide for unauthorized targeting.

Set up OpenClaw, Hermes, or LangChain Deep Agents inside NVIDIA OpenShell with a reference stack that combines guided onboarding, routed inference, network policy, and sandbox lifecycle management behind one CLI. The project focuses on safer long-running agent operation and controlled egress. It is currently described as alpha, with community support provided on a best-effort basis.

PentAGI lets autonomous agents plan and execute authorized penetration-testing work inside an isolated Docker environment. It includes more than twenty security tools such as nmap, Metasploit, and sqlmap, and can retain useful findings for later tasks. Cloud and local models are supported; smaller open models benefit from execution monitoring and task planning at the cost of higher token usage.