defi0x1

App Security Skills — Security skill for Claude Code

Security community

Claude Code skill: security + code review in one pass.

How to install App Security Skills

This entry records only its repository, not the path inside it, so there is no exact command to give. Open defi0x1/app-security-skills and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What App Security Skills does

Claude Code skill: security + code review in one pass. Evidence-gated findings, invariant-based hunting, deep multi-agent audit engine, read-only.

Alternatives in Security

Pocketpaw — Your AI agent in 30 seconds 775 ★
CodexQB — CodexQB is a Codex plugin for evidence-backed repo comprehension, planning, QA audit, and gated implementation 186 ★
Postgres — Execute safe read-only SQL queries against PostgreSQL databases with multi-connection support and defense-in-d 159 ★

README

appsec

**A code review skill for Claude Code: security and code quality in one pass, reporting only what it can prove.**

[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![Version](https://img.shields.io/badge/version-0.4.1-informational.svg)](CHANGELOG.md) [![Claude Code skill](https://img.shields.io/badge/Claude%20Code-skill-D97757.svg)](https://docs.claude.com/en/docs/claude-code/skills)

Most automated reviews either bury you in plausible-sounding noise or miss the bug that lives in the *gap between two components*. `appsec` addresses both: every finding must pass explicit verification gates, facts the repository cannot prove are labelled **Needs validation** instead of guessed, and hunting is driven by *invariants and trust boundaries* instead of keyword lists.

Run `/appsec`. It detects the scope (your branch, an MR/PR, or the whole repo), decides how deep to go, picks the relevant domain playbooks, and returns a structured report with a merge verdict. It does not ask questions unless it cannot continue. It is read-only: no checkout, no stash, no files in your project, no probing of deployed systems.

What it reviews

Security track

Core classes: injection, access control, authentication and session, SSRF, XSS, deserialization, cryptography, DoS, races, secrets, supply chain, CI/CD.
Ten domain playbooks, selected automatically from the trust boundaries your diff touches:

Domain	Hunts for
`web-auth`	HTTP desync and request smuggling, cache poisoning and deception, trusted-Host bugs, CSRF, session fixation, JWT/OAuth/SAML binding, MFA, passkey and account-recovery state transitions, API-key scope, mTLS fail-open
`client-side`	DOM XSS, DOM clobbering, prototype pollution with a real gadget, `postMessage`, cross-site WebSocket hijacking, CORS, service-worker scope, X