This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
WARNING] > Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only.
Specialised AI models for logo design — a brand-analysis model turns a business into constraints, typography and symbol models construct the mark, and a composition engine produces real lockups and clear-space rules. Early access open.
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities. com/oss-scanner.
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies.
Airgorah is a WiFi security auditing software that can capture nearby WiFi traffic, discover clients connected to access points, perform deauthentication attacks, capture handshakes and PMKIDs, and crack the password of access points.
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Fluentd: Open-Source Log Collector ===================================
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering.
For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden.
The Practical Linux Hardening Guide provides a high-level overview of hardening GNU/Linux systems. It is not an official standard or handbook but it touches and uses industry standards.
> Beta — A single-binary Kubernetes attack path engine for authorized security assessments.
Pre-auth RCE on Microsoft Exchange Server. No credentials needed.
Clevis turns the GitHub API into a dashboard. Track repository activity, audit organization security posture, and run privileged maintenance jobs — from a single, dense, self-hosted control panel.
The easiest option in Codex is to ask the built-in installer to install this repository:
That is the whole thing. init walks you through it: pick the folder, pick your coding CLI, pick the model, choose review-or-fix, and it runs.
grantdecay finds privilege that was granted and never used. It reads an entitlement export (principals, roles, and the permissions each role confers) plus an access log export covering a stated window, then reports the unused privilege surface.