#owasp

实战 SRC / 众测 / Bug bounty 漏洞挖掘 Claude Code skill — 19 个攻击类 playbook、305 个结构化 payload、263 个 WAF/EDR 绕过、2887 份 HackerOne 真实案例、88,636 WooYun 案例统计

Prueba de seguridad, con Claude Code, a esa app que hiciste con IA. 20 fallas comunes, scanners gratis, prompts y blindaje.

AI IR Overlay™ — practical incident response framework for AI agents in production. Built on NIST SP 800-61 r3, mapped to NIST AI RMF, NIST CSF 2.0, OWASP Top 10 for Agentic Applications 2026, ISO/IEC 42001, EU AI Act.

Border Guard — AI-native territory sovereignty & self-evolving security OS. 6-module D-S fusion engine, trajectory detection, anchor detection, fission engine, territory adjudicator. Full design + Python implementation.

Offline, no-AI "safe to ship?" gate for vibe-coded apps — finds the security mistakes AI coding agents make (secrets, unprotected routes, eval-RCE, SQLi, CORS, JWT, leaked keys). CLI + MCP, agent-runnable.

Memory integrity for AI agents — Information-flow control against OWASP ASI06 memory & context poisoning.

Software Quality Assurance Agent para Claude Code — ISO/IEC 25010, OWASP, ISO 27001

Skill de sécurité applicative pour agents de code IA (Claude Code, Cursor, Codex) — détection, explication, correction et scoring OWASP/ASVS.

The complete security auditor for Claude Code — web, API, mobile, cloud, wireless, code, secrets, dependencies, IaC, containers and LLM apps. Token-optimised, exploitation-ranked, self-updating.

Universal security audit skill for Claude Code — OWASP Top 10 (2021) + Russian security standards (ГОСТ Р 56939, ФСТЭК, ФЗ-152) + STRIDE threat modeling. Multi-stack: Node/Python/Go/Rust.

Audit-ready pentest reports (DE/EN) with built-in compliance checks for BSI, OWASP, PCI-DSS, DiGA & OSCP. A Claude skill + standalone Python pipeline.

Lab notebooks and the SupportFlow sandbox agent for the Agentic AI Governance for GRC & Cybersecurity course. Review a real AI agent that reads customer data, calls tools, and moves money.

Security testing skill for OS command injection and argument injection. Claude Code skill format.

Autonomous multi-agent AI penetration testing framework — 20 specialist agents, ECC architecture, MITRE ATT&CK + OWASP mapped, HMAC-chained audit trail, Docker sandbox, and multi-LLM backend (Ollama/OpenAI/Anthropic).

Free AI-agent risk self-check, security checklist, and USD 59 launch-readiness mini-audit offer.

A coaching harness for Claude Code: team memory, evidence-backed prompt coaching, injection defense, onboarding docs, verified research and business analysis — nine coaches on one engine, every claim backed by evidence.

Defense-in-depth security rules AI coding agents can follow, and verify. 25 rule chapters, checklists, drop-in CLAUDE.md, self-verification test patterns.

Interactive, OWASP LLM Top 10-grounded teaching lab for LLM/RAG threat modeling. Includes a real-time incident scenario chaining data poisoning, indirect prompt injection, and cross-tenant data leakage.

Empirical evidence that OWASP AISVS C9.2 has no accountability axis: an action an AI agent cannot be answerable for reaches human-owned execution only through a false input. By K. Lunina.

Local-first security release checker for authorized code, AI apps, freelancers, and small teams

Audit your vibe-coded app for security holes (secrets, RLS, auth, injection, config), score it, and — with your approval — fix them in your code. A Claude Code / Codex skill. By Kapus.

Claude Code skill for auditing Next.js apps for secrets exposed in the client JS bundle

Route coding tasks through an automated 8-agent pipeline for optimized, secure, and production-ready code output in Claude Code.

Security auditor and scanner for AI-built (vibe-coded) apps — a Claude Code skill + standalone cross-stack scanner.

Security review skill for Claude Code, Codex and Opencode that reports only exploitable findings: every candidate goes through a separate refutation pass. Code, branch diffs, Kubernetes, Terraform, CI/CD, AI agents.

An AI red-team agent for authorized labs and web app pentesting workflows. Turns Claude Code / OpenCode / Codex into a structured recon → test → exploit → report workflow, with containerized tools and resumable state.

Layered operator screening and session-hijack resistance for AI-agent platforms (alpha)

A command-line red-team scanner for LLM agents. 21 techniques, zero dependencies, reports as JSON, SARIF or Markdown. Every finding carries the prompt and reply behind it.

Universal Pre-Launch Security (Low-to-Critical) & UI/UX Design Bug Finder + 6-Stage Adversarial Audit Loop for Vibe-Coded Apps (Claude Code, VS Code Copilot, OpenAI Codex, Cursor, Windsurf, Gemini CLI)

Authorized attack-surface discovery: Playwright crawler + safe vulnerability detection (headers, TLS, CORS, exposed files, GraphQL) + OWASP/CWE risk mapping, interactive Next.js dashboard, PDF/MD/JSON reports