Claude Skill MartBrowse skillsWhat is a Skill?
 
← Back to list

Security Research (Team-Mode Vulnerability Audit)

Runs 3 vulnerability hunters and 2 PoC engineers in parallel so only findings with a proven attack path get reported.

Security & ReviewAdvanced★ 67,531⑂ 5,507AI score 8/10Last updated: Aug 9, 2026

What it does

Spins up a 5-member parallel security audit team over a repo, diff, PR, or release candidate:

  • surface-hunter: maps entry points, trust boundaries, attacker-controlled inputs, privilege transitions
  • auth-data-hunter: hunts auth/authorization, tenant data isolation, injection, SSRF, credential exposure, confused-deputy issues
  • runtime-supply-hunter: hunts filesystem, subprocess, archive extraction, dependency, hook, MCP, and env-var risks
  • poc-engineer-a/b: one builds minimal safe PoCs, the other independently tries to falsify or downgrade them

The governing rule is "no severity without an attack path." Root causes are classified with CWE, methodology follows OWASP WSTG/ASVS, and exploitability/impact are scored with CVSS v4.0. The output is a report that leads with a PASS / PASS WITH FINDINGS / BLOCK verdict, plus a findings table, per-finding evidence, attack path, minimal fix, regression check, downgraded candidates, and residual risk.

Who it's for

  • Teams doing a final security pass before shipping
  • Leads who want reproducible vulnerabilities instead of generic hardening advice
  • Developers touching auth, multi-tenancy, file uploads, or subprocess execution
  • Reviewers of CLIs, MCP servers, and plugin hooks where supply-chain risk is real

Note: it hard-requires team_mode.enabled: true in your oh-my-openagent config and must run in the main session.

Examples

  1. PR security review: "Audit this PR with security-research" — scope is limited to the diff vs. the base ref, and the changed auth logic either gets a working bypass PoC or gets downgraded.
  2. Pre-release full audit: with no target given, it audits security-sensitive surfaces in the working tree, collects path-traversal and command-injection candidates, and only promotes to High what reproduces against local fixtures.
  3. Threat-model validation: tell it "we're worried about archive extraction and remote downloads" and runtime-supply-hunter focuses there, concluding with a static or dry-run proof instead of a destructive exploit.

· · · Install guide · · ·

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .agents/skills/security-research folder from the GitHub repo code-yeongyu/oh-my-openagent into my ~/.claude/skills/security-research/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/code-yeongyu/oh-my-openagent.git && mkdir -p ~/.claude/skills && cp -r oh-my-openagent/.agents/skills/security-research ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Clone the repo: git clone https://github.com/code-yeongyu/oh-my-openagent.git
  3. Create the skills directory: mkdir -p ~/.claude/skills
  4. Copy the skill: cp -r oh-my-openagent/.agents/skills/security-research ~/.claude/skills/
  5. (Required for team mode) Set team_mode.enabled: true in your oh-my-openagent / opencode config and restart opencode. Without team mode, adapt the prompts to run the 5 roles sequentially.
  6. Restart Claude Code (or opencode) and ask: "Run security-research on this repository."
  7. State constraints up front — e.g. no network calls, no destructive exploits against real systems.
View source on GitHub ↗License: NOASSERTION