gonimar

Appsec Engineer — Security agent for Claude Code

Security community

Application Security Engineer (Tier 3): reviews and tests code against OWASP Top 10:2025 / ASVS — authentication, sessions, JWT, authorization/IDOR, injection, XSS, SSRF, file upload, webhooks, secret.

How to install Appsec Engineer

Installs to ~/.claude/agents/gonimar-claude-web-studio-appsec-engineer.md

Terminal
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/gonimar/claude-web-studio/HEAD/agents/appsec-engineer.md -o ~/.claude/agents/gonimar-claude-web-studio-appsec-engineer.md

Restart Claude Code, or start a new session, for it to be picked up.

What Appsec Engineer does

name: appsec-engineer description: "Application Security Engineer (Tier 3): reviews and tests code against OWASP Top 10:2025 / ASVS — authentication, sessions, JWT, authorization/IDOR, injection, XSS, SSRF, file upload, webhooks, secrets, crypto, GraphQL limits; runs SAST/dependency tools and writes security regression tests; performs authorised dynamic testing of the project's own app (ZAP, Nuclei, Schemathesis). Use for security code review, /security-audit, /pentest." tools: Read, Glob, G

Alternatives in Security

  • JS Analyzer — JavaScript static analysis agent for client-side security review 812 ★
  • Security Audit Analyzer — Комплексный анализ безопасности веб-приложений с JavaScript frontend и PHP backend 571 ★
  • Dashclaw Security Reviewer — Read-only security reviewer specialized for the DashClaw stack (Next.js 16 App Router, Neon/Postgres via repos 297 ★

Full documentation available on GitHub

View Source Repository

Related Agents

AI Security — Security agent for Claude Code

AI Security

Security review for a change in a project with .ai/ — authentication, authorization, secrets, personal and pay

Security community
Ehs Web API — Security agent for Claude Code

Ehs Web API

Web, backend and API security specialist for the Ethical Hacker Squad. Reviews authentication, object- and fun

Security community
Afc Appsec Expert — Security agent for Claude Code

Afc Appsec Expert

Application Security specialist — remembers security architecture decisions and threat models across sessions

Security community
API Attacker — Security agent for Claude Code

API Attacker

API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignmen

Security community
Pentester — Security agent for Claude Code

Pentester

Adversarial security expert. Thinks like an attacker — chains primitives into exploits, finds auth bypass, IDO

Security community
Lens Security — Security agent for Claude Code

Lens Security

Security lens of the production readiness audit. Attacks the codebase on paper - injection, SSRF, path travers

Security community

Related Skills

Audit Security — Security skill for Claude Code

Audit Security

Security audit (OWASP Top 10, PHP-specific vulnerabilities). Analyzes input validation, injection, authenticat

Security community
Pre Ship Security Red Team — Security skill for Claude Code

Pre Ship Security Red Team

Agent skill that red-teams a web app you own before launch: three subagents run 14 authorization and abuse che

Security community
Vibesec — Data skill for Claude Code

Vibesec

Helps write secure code by preventing common vulnerabilities including IDOR, XSS, SQL injection, SSRF, and wea

Data community