Cybersec Audit Skill — Security skill for Claude Code

Cybersecurity Audit Skill

A Claude Agent skill that performs **hybrid source code security audits** — deterministic pattern scanning, SAST tool integration (semgrep/bandit/snyk/trivy), LLM contextual analysis, and architecture-level finding detection. Produces Markdown and JSON reports with optional auto-fix capability.

Includes intentionally vulnerable demo apps (Flask, Node.js, Go, React) to demonstrate the audit capability live.

---

Setup

Choose your environment below. Step 2 (SAST tools) and Step 3 (output directory) are the same for both.

---

Option A — Claude Code (Anthropic CLI)

Claude Code uses `CLAUDE.md` for persistent instructions and `.claude/skills/` for reusable slash-command workflows.

**Step A1 — Install as a global skill (available in any project)**

# Create the global skills directory
mkdir -p ~/.claude/skills/cybersecurity-audit

# Copy the skill file
cp SKILL.md ~/.claude/skills/cybersecurity-audit/SKILL.md

Invoke it in any Claude Code session with:

/cybersecurity-audit

**Step A2 — Or install as a project-level skill (scoped to this repo)**

# Run from inside the cloned repo
mkdir -p .claude/skills/cybersecurity-audit
cp SKILL.md .claude/skills/cybersecurity-audit/SKILL.md

Invoke it the same way:

/cybersecurity-audit

**Step A3 — Or inject via CLAUDE.md (no slash command needed)**

If you prefer the skill to load automatically for every session in this repo, append it to your project's `CLAUDE.md`:

cat SKILL.md >> CLAUDE.md

Or create a user-level CLAUDE.md so the skill is always available globally:

cat SKILL.md >> ~/.claude/CLAUDE.md

**Verify it's loaded:**

# Inside the repo, start a Claude Code session and run:
/claude
# Then type /cybersecurity-audit — it should appear in autocomplete

---

Option B — Hermes CLI

Hermes uses a `~/.hermes/skills/` directory with category subdirectories.

**Step B1 — Copy the skill into Hermes**

# Cre