GodModeAI2025

Breachguard — Security skill for Claude Code

Security community

Methodology-driven Claude skill for security and code-quality audits, with threat modeling, false-positive verification and structured findings.

How to install Breachguard

This entry records only its repository, not the path inside it, so there is no exact command to give. Open GodModeAI2025/breachguard and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Breachguard does

Methodology-driven Claude skill for security and code-quality audits, with threat modeling, false-positive verification and structured findings.

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
/web3 Audit — Smart contract security audit using the 10-bug-class methodology 927 ★
Clawsec — Security skill suite with drift detection, automated audits, and skill integrity verification 798 ★

README

breachguard

**A methodology-driven security-audit skill for Claude.** Inspired by the practice of experienced audit firms: structure first, findings second, false-positive verification before every conclusion.

breachguard is not a scanner. It is a framework that guides Claude through the same phases a senior auditor walks: intake, context, lens application, FP-verification, reporting. Output is structured, calibrated by confidence, and survives peer review.

What this is

A Claude skill (single .skill archive) you load in Claude.ai, Claude Desktop, or Claude Code
283 lenses across 27 domains — security is 14 of them; the rest cover performance, architecture, code quality, testing, documentation, API design, database, concurrency, error handling, observability, DevOps, frontend, UX, i18n, compliance, and OSS-readiness
12 operating modes — audit, triage, deep-audit, variant, verify-fix, bugfix, feature, discover, deploy, custom, opensource, content
6 role personas — Auditor, Developer, Architect, Reporter, Agent, Detector
5-phase workflow — Intake → Context → Lens → FP-Verification → Report
6 FP-Gates — every finding passes through Sink, Source, Reachability, Validation, Attacker-Control, Impact before getting a verdict
20 bug-class verification rubrics — SQL injection, XSS, CSRF, auth bypass, secret exposure, crypto misuse, etc. — each with concrete checks
Attacker-Model framework — WHO / ACCESS / INTERFACE triples that force explicit threat-modeling instead of vague "an attacker"

What this isn't

Not a replacement for a professional security firm or pentest
Not a CVE-scanner — it complements SAST/SCA tools, doesn't replace them
Not for mobile-app-specific audits (use OWASP MAS — there's an owasp-mas skill for that)
Not for prompt-injection scanning of LLM prompts/documents (use prompt-injection-scanner)
Not for pure UX/design review (use enbw-impeccable or