Comprehensive security analysis suite that identifies vulnerabilities across HTTP, auth, integrations, dependencies, infrastructure, and business logic through a multi-phase agent pipeline with exploit PoCs and remediation plans. Use when the user wants a security audit, penetration test, threat model, vulnerability hunt, security fix plan, SBOM, compliance mapping, privacy assessment, or security posture comparison between runs.
Repository: https://github.com/paixaop/security-analyst
Comprehensive security analysis suite that identifies vulnerabilities, assesses exploitability, and generates actionable remediation plans. Coordinates specialized agents through a multi-phase pipeline — built for developers and security researchers who want depth, not checkbox compliance.
| Command | Purpose | Agents | Output |
|---------|---------|--------|--------|
| /security-analyst | Interactive — choose scope and output mode | Varies | Varies |
| /security-analyst:full | All 9 phases, all attack surfaces | 33+ | Full run directory |
| /security-analyst:focused [component] | Target a specific area (e.g., authentication, data pipeline) | 3-6 | Inline findings |
| /security-analyst:recon | Phase 0 only — codebase security map | 14 (parallel) | Recon index + step files |
| /security-analyst:threat-model | Recon + STRIDE analysis + attack trees | 1+ | Threat model doc |
| /security-analyst:variant-hunt [vuln] | Find all unpatched variants of a known vulnerability | 2-6 | Variant findings |
| /security-analyst:fix-plan [run-dir] | Generate implementation plan from existing report | 1 | Fix plan |
| /security-analyst:sbom | Software Bill of Materials — recon + dependency audit only | 15 | SBOM report |
| /security-analyst:diff [run-a] [run-b] | Compare two runs — new, resolved, persistent findings | 1 | Delta report |
| /security-analyst:compliance [framework] | Map findings to SOC 2 / ISO 27001 / PCI DSS / HIPAA / GDPR | 1 | Compliance report |
| /security-analyst:privacy | Privacy assessment — PII flows, consent, data subject rights | 15+ | Privacy report |
| /security-analyst:update-knowledge | Refresh OWASP cheat sheets, Top 10 lists, and CWE Top 25 | 1 | Updated knowledge files |
| /security-analyst:create-plugin [framework] | Generate a framework-specific security plugin | 0 | Plugin file |
| /security-analyst:create-plugin [framework] [file] | Generate a plugin using a reference file | 0 | Plugin file |
| /security-analyst:contribute-plugin [plugin-name] | Open a PR to contribute a plugin to the project | 0 | GitHub PR |
Analysis runs in dependency-ordered execution groups. Each group's findings feed the next. Groups are execution-order groupings of phases. Finding IDs use category prefixes (HTTP, INJ, DEP, etc.).
Recon: Reconnaissance (14 agents, all parallel — 2 waves)
└─ Wave A (12 agents, batch-spawned): metadata, docs, HTTP, boundaries, crown jewels, auth, integrations, secrets, security work, config, frontend, deps
└─ Wave B (2 agents, batch-spawned): data flows, scope notes (depend on Wave A)
└─ Assembly: orchestrator builds recon/index.md from LOD-0+1 returns
Knowledge: KnowledgeRouter (1 agent, after recon)
└─ Selects OWASP/CWE knowledge files matching the project's stack
└─ Output injected as grounding context into every downstream agent
Surface: Attack Surface + Git History + Dependencies + Config (up to 27 agents, batch-spawned in parallel)
├─ HTTP entry points, authz rules, integrations, frontend
├─ LLM/AI security (OWASP Top 10 for LLM Applications)
├─ API schema validation (OpenAPI, GraphQL, gRPC)
├─ WebSocket / SSE real-time security
├─ File upload security
├─ Backdoor detection (hidden endpoints, obfuscated code, supply chain backdoors, data exfiltration)
├─ Cryptography audit (weak algorithms, key management, TLS, JWT, password hashing)
├─ Deserialization security (pickle, ObjectInputStream, prototype pollution, XXE)
├─ OAuth/OIDC/SSO security (redirect URI, state/PKCE, token handling, SAML)
├─ Rate limiting & abuse prevention (brute force, enumeration, API abuse, CAPTCHA)
├─ Logging & monitoring (sensitive data in logs, missing audit trails, log injection)
├─ Caching security (cache poisoning, sensitive data leakage, CDN abuse)
├─ Memory safety (buffer overflows, use-after-free, unsafe code, native addons)
├─ Serverless security (IAM roles, event injection, Lambda/Cloud Functions)
├─ Third-party script security (CSP, SRI, tag managers, external scripts)
├─ Error handling & info disclosure (stack traces, debug endpoints, verbose errors)
├─ Injection/auth/SSRF/data-exposure variant hunting via git history
├─ Dependency audit (npm audit, supply chain)
├─ Infrastructure config, secrets, KMS, IAM
├─ CI/CD pipeline security (GitHub Actions, GitLab CI)
└─ Container security (Docker, Kubernetes)
┌─ SBOM Assembly (orchestrator, no agent — runs in parallel with logic stage)
│
Logic: Business Logic (4 agents batch-spawned, needs surface stage)
├─ Race conditions and TOCTOU
├─ Authorization escalation and IDOR
├─ Pipeline exploitation (input → AI → decision → action)
└─ DoS and resource exhaustion
Tracing: Data Flow Tracing (up to 4 agents batch-spawned, needs surface + logic)
└─ End-to-end trace of critical data flows with sanitization gap analysis
Exploits: Exploit Development (1 agent, needs all findings)
└─ Develops complete exploits with PoCs, CVSS scores, CWE/ATT&CK IDs, chains
Validation: Finding Validation (1 critic agent)
└─ Adversarial review — catches false positives, validates fixes, adjusts severity
Reporting: Final Report (1 agent)
└─ Executive summary, risk dashboard, remediation roadmap
Remediation: Fix Plan (1 agent)
└─ Actionable tasks with fix code, regression tests, effort estimates
Every Medium+ finding includes: CVSS 3.1 score, CWE ID, MITRE ATT&CK technique, exploit scoring (exploitability/blast radius/detectability/remediation ROI), attack steps, proof-of-concept, concrete fix code, and regression test.
Full runs write to docs/security/runs/{YYYY-MM-DD-HHMMSS}/:
| File | Content |
|------|---------|
| recon/index.md | Recon LOD-0 + LOD-1 index |
| recon/step-*.md | 14 atomic LOD-2 recon section files |
| findings/ | Atomic LOD-2 finding files + index |
| reports/surface.md | Attack surface, git history, deps, config |
| reports/sbom.md | Software Bill of Materials (deps, licenses, supply chain) |
| reports/logic.md | Business logic exploitation |
| reports/tracing.md | Data flow tracing |
| reports/exploits.md | Exploit catalog with PoCs |
| reports/validation.md | Validated findings |
| reports/executive-report.md | Executive security report |
| reports/fix-plan.md | Implementation plan |
| reports/project-recon.md | Full LOD-2 consolidated recon report |
| reports/compliance.md | Compliance mapping (when requested) |
| reports/delta.md | Delta between two runs (when requested) |
| reports/privacy.md | Privacy & data protection assessment (when requested) |
| checkpoint.md | Stage completion tracking (enables resume on failure) |
The orchestrator writes checkpoint.md after each stage completes. If a run is interrupted (session loss, timeout, error), re-running the same command reads the checkpoint, skips all completed stages, and resumes from the first incomplete stage. All on-disk data from completed stages (recon index, findings, reports) is preserved and reused. No work is repeated. See the Troubleshooting section for details.
Runs all 9 phases with no prompts. Most thorough — spawns up to 38+ agents across 6 execution groups. Expect significant processing time.
/security-analyst:full
Analyzes a specific component with only relevant agents. Faster (3-6 agents) but still thorough within scope. Findings presented inline — no separate report.
/security-analyst:focused authentication
/security-analyst:focused data processing pipeline
/security-analyst:focused frontend
/security-analyst:focused database rules
/security-analyst:focused AI integration
/security-analyst:focused CI/CD
/security-analyst:focused containers
/security-analyst:focused API
/security-analyst:focused real-time
/security-analyst:focused file uploads
Quick security map without vulnerability analysis. Good for orientation before a full audit or for manual review planning.
/security-analyst:recon
Recon plus STRIDE analysis on each trust boundary, attack trees for each crown jewel, and a risk matrix. Useful for compliance (SOC 2, ISO 27001) and security planning.
/security-analyst:threat-model
Given a known vulnerability (commit hash, CVE, or description), systematically finds all unpatched variants using git history mining and pattern analysis.
/security-analyst:variant-hunt 6dc9bb7
/security-analyst:variant-hunt OData injection
/security-analyst:variant-hunt CVE-2024-XXXX
Generates a compliance-ready SBOM covering all languages, frameworks, direct and transitive dependencies, licenses, and supply chain health indicators. Runs recon plus the dependency audit agent only — no exploitation or attack surface analysis.
/security-analyst:sbom
Compares two security analysis runs to highlight new, resolved, and persistent findings. Tracks dependency changes, attack surface evolution, and fix plan progress. Auto-detects the two most recent runs or accepts specific run directories.
/security-analyst:diff
/security-analyst:diff docs/security/runs/2025-06-01-100000 docs/security/runs/2025-06-15-143022
Maps findings from an existing security run to a compliance framework. Assesses each control as Pass/Partial/Fail/N/A and produces a compliance score with gap analysis.
/security-analyst:compliance soc2
/security-analyst:compliance iso27001
/security-analyst:compliance pci-dss
/security-analyst:compliance hipaa
/security-analyst:compliance gdpr
Traces all PII data flows, evaluates consent mechanisms, checks data subject rights implementation (access, erasure, portability), reviews data retention and deletion, and assesses cross-border transfers. Can run standalone or enrich an existing security run.
/security-analyst:privacy
Refreshes the local vulnerability knowledge base used to ground all findings. Updates OWASP Cheat Sheets (via git submodule), OWASP Top 10 lists (Web, API, LLM), and CWE Top 25 entries. The knowledge base lives at references/knowledge/ inside the skill directory. Run this before your first full analysis and periodically thereafter to keep patterns current.
/security-analyst:update-knowledge
Generates an implementation plan from an existing security report. Auto-detects the latest run or accepts a specific run directory. Tasks are prioritized: Quick Wins, Immediate, Short-term, Medium-term, Backlog.
/security-analyst:fix-plan
/security-analyst:fix-plan docs/security/runs/2025-06-15-143022
Creates a new framework-specific security plugin. Validates against existing plugins for overlap, checks base agent prompts for duplicate coverage, researches framework security characteristics, and generates the plugin file with detection criteria and agent-specific security checks.
Accepts an optional reference file (documentation, security guide, OWASP cheat sheet) as input to inform the plugin content.
/security-analyst:create-plugin Flask
/security-analyst:create-plugin "Ruby on Rails"
/security-analyst:create-plugin Svelte
/security-analyst:create-plugin "AWS Lambda" docs/aws-lambda-security.md
/security-analyst:create-plugin Rust path/to/rust-security-guide.pdf
/security-analyst:create-plugin Supabase
Opens a pull request to contribute a plugin to the security-analyst project repository. Validates the plugin file, creates a feature branch, and opens a PR with a structured description. Requires the gh CLI.
/security-analyst:contribute-plugin flask
/security-analyst:contribute-plugin aws-lambda
/security-analyst:contribute-plugin supabase
Example 1: Full security audit before production deploy
User says: "Run a full security audit on this project"
Actions:
Result: Complete security report in docs/security/runs/{timestamp}/reports/executive-report.md with CVSS-scored findings, PoCs, and a prioritized fix plan.
Example 2: Targeted analysis of a single component
User says: "Check the authentication system for vulnerabilities"
Actions:
Result: Focused findings with exploit steps and fix code, delivered inline without a full run directory.
Example 3: Compliance prep after a security run
User says: "Map findings to SOC 2 controls"
Actions:
docs/security/runs/Result: Compliance report in reports/compliance.md with control-level status and remediation guidance.
Example 4: Tracking security posture over time
User says: "Compare the last two security runs"
Actions:
docs/security/runs/Result: Delta report showing security posture improvements and regressions.
For detailed architecture reference (directory structure, agent design, LOD architecture, customization), see references/architecture.md. For all constants (paths, filenames, agent registry, placeholders), see references/constants.md. For platform-specific tool mapping (Cursor vs Claude Code vs Codex) and hang prevention, see references/platform-tools.md.
Key concepts:
/security-analyst:create-plugin. See references/plugins/README.mdThis skill performs comprehensive security analysis. It instructs agents to read large portions of your repository (including environment and secrets files), run dependency auditors, mine git history, and write proof-of-concept reproductions and reports to disk. Before installing or running it:
docs/security/runs/ by default. Choose a safe output directory (configurable in references/constants.md), review artifacts promptly, and delete or secure them after triage.git and benefits from npm audit, pip-audit, govulncheck, and other ecosystem tools. See Requirements for the full list and fallback behavior./security-analyst:recon command is a good low-risk starting point — it maps the codebase without producing exploits./plugin marketplace add paixaop/security-analyst
/plugin install security-analyst
This works in both Claude Code and Cursor.
# Clone and run the install script
git clone https://github.com/paixaop/security-analyst.git
cd security-analyst
./install.sh
# Or copy directly
cp -r plugin/skills/security-analyst ~/.claude/skills/security-analyst # Claude Code
cp -r plugin/skills/security-analyst ~/.cursor/skills/security-analyst # Cursor
The skill requires read access to the project codebase and write access to the project directory. Agents use Read, Grep, and Glob to analyze source files, and full runs write output to docs/security/runs/{YYYY-MM-DD-HHMMSS}/ inside the project workspace. The project being analyzed must be the current working directory.
All agents are spawned as generalPurpose subagents via the Task tool and require:
| Tool | Purpose | |------|---------| | Task | Spawn and coordinate subagents (Claude Code, Cursor, Codex) | | Bash / Shell | Run git commands, dependency auditors, and inline scripts | | Read | Read source files, configs, lockfiles, and prior-stage outputs | | Grep | Search for patterns across the codebase | | Glob | Find files by name/extension patterns | | Write | Write findings, reports, and recon step files to the run directory |
See references/platform-tools.md for platform-specific availability (Cursor vs Claude Code vs Codex).
gitGit is a hard dependency. Four agents mine git history (git log, git diff, git show, git blame) to find unpatched vulnerability variants. The dependency audit agent uses git ls-files to verify lockfile integrity. The variant-hunt command relies entirely on git history analysis. If the project is not a git repository, history-based agents will produce no findings and the variant-hunt command will not function.
The dependency audit agent attempts to run vulnerability scanners for detected package ecosystems. These tools are not required — if unavailable, the agent falls back to static analysis of manifest and lockfiles, but automated CVE detection will be less thorough.
| Ecosystem | Tool | Invocation | Fallback |
|-----------|------|------------|----------|
| Node.js | npm | npm audit --json | Parse package.json + package-lock.json directly |
| Python | pip-audit | pip-audit --json | Parse requirements.txt / pyproject.toml directly |
| Go | govulncheck | govulncheck ./... | Parse go.mod / go.sum directly |
The agent also runs inline Node.js scripts (via node -e) to extract license data from node_modules/ when present. No global npm packages are installed — only project-local tooling is used.
The SBOM report template references machine-readable export tools. These are documentation-only recommendations — the skill does not attempt to run them automatically. The SBOM report is always generated from the dependency audit agent's static analysis regardless of whether these tools are installed.
| Format | Tool |
|--------|------|
| CycloneDX | npx @cyclonedx/cyclonedx-npm, cyclonedx-py, cyclonedx-gomod |
| SPDX | spdx-sbom-generator, syft |
No credentials, API keys, or authentication tokens are required. All analysis is performed locally against the project source code and git history. The compliance and privacy commands assess implementation by reading code — they do not connect to external compliance platforms.
This skill performs deep security analysis. By design, it reads broadly, looks for weaknesses, and produces proof-of-concept reproductions. The following sections describe the data and safety surfaces so users can make an informed decision before running it.
Agents are instructed to read all files in the project workspace, including source code, configuration, environment files, lockfiles, CI/CD pipelines, Dockerfiles, and infrastructure-as-code. This is inherent to security analysis — the skill cannot find vulnerabilities in code it cannot read. Specific high-sensitivity reads include:
API_KEY=, SECRET=, PASSWORD=, and read .env* files, credentials* files, and config files to identify hardcoded secrets. The config-infrastructure agent is explicitly instructed to redact the actual secret in findings — only file paths and pattern types are reported, not secret values.git log, git diff, and git show to find previously-fixed vulnerabilities and check for incomplete remediation. This can surface deleted secrets that persist in git history.Read specific code without re-scanning. This is an efficiencySearch for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer