arm-pz

Pre Ship Security Red Team — Security skill for Claude Code

Security community

How to install Pre Ship Security Red Team

This entry records only its repository, not the path inside it, so there is no exact command to give. Open arm-pz/pre-ship-security-red-team and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Pre Ship Security Red Team does

Agent skill that red-teams a web app you own before launch: three subagents run 14 authorization and abuse checks (IDOR, role escalation, quota races, open redirects, XSS, SSRF, cache leaks, prompt injection) with captured evidence, then fix and rerun. Local isolated environments only. Claude Code, Cursor, Qoder.

Alternatives in Security

Security Guidance — Hook that warns about command injection, XSS, and unsafe patterns 14k ★
T3mp3st — autonomous red teaming platform; multi-agent offensive-security meta-harness 5.7k ★
Spring-ai MCP Security — Authorization framework for MCP client/server using Spring Security 85 ★

README

pre-ship-security-red-team

Run the attacks before your users do. An agent skill for Claude Code, Cursor and Qoder that red-teams a web application **you own**: three subagents, each with its own synthetic User A, User B and Admin accounts, actually execute 14 authorization and abuse checks (IDOR, self-service role escalation, password-reset token reuse, UI-disabled request bypass, quota and free-tier bypass, concurrent quota races, hostile input, open redirects, stored XSS, SSRF, private-response and cache leakage, preview exposure, prompt injection through ingested content), record a request and a response per row, then one agent fixes every failure and reruns with a negative control that proves the test can detect the bug.

Install

npx skills add arm-pz/pre-ship-security-red-team --skill pre-ship-security-red-team

Or place the skill folder in your agent's skills directory, for example:

# Claude Code (project)
mkdir -p .claude/skills/pre-ship-security-red-team && cp -r SKILL.md scripts references assets .claude/skills/pre-ship-security-red-team/
# Qoder (user)
mkdir -p ~/.qoder/skills/pre-ship-security-red-team && cp -r SKILL.md scripts references assets ~/.qoder/skills/pre-ship-security-red-team/

The folder needs `SKILL.md` plus `scripts/`, `references/` and `assets/`: the workflow runs two Node scripts (`scaffold_run.mjs`, `check_results.mjs`, Node.js 18 or newer) and reads its row definitions from `assets/results-table.md`.

This repo is also a Claude Code plugin (`.claude-plugin/plugin.json`); it is listed in the `arm-pz/caffeinity-skills` marketplace.

Ask it things like

/pre-ship-security-red-team http://127.0.0.1:3000 — play the bad guy before I ship
Test whether user A can read or delete user B's data, then fix it and prove the fix
Check that my free-tier limits and rate limits hold when someone bypasses the UI
Is my vibe-coded site safe to launch