kulchankas

Hack Me — Security skill for Claude Code

Security community

Attack your own running app on localhost, prove each vuln is real, patch it, and re-verify.

How to install Hack Me

Installs to ~/.claude/skills/kulchankas-paranoid-hack-me/SKILL.md

Terminal

mkdir -p ~/.claude/skills/kulchankas-paranoid-hack-me && curl -fsSL https://raw.githubusercontent.com/kulchankas/paranoid/HEAD/commands/hack-me.md -o ~/.claude/skills/kulchankas-paranoid-hack-me/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Hack Me does

description: Attack your own running app on localhost, prove each vuln is real, patch it, and re-verify.

/hack-me

Turn the `paranoid` review into proof. Instead of *telling* the user their code has an IDOR, you demonstrate it against their own app on localhost, then fix it and show the exploit now fails.

Scope — read first, enforce always

This runs **only** against an app the user owns and is running locally. Before touching anything:

Target must be local. localhost, `1

Alternatives in Security

Maestro Odyssey — Long-running iterative cycle — one entry, seven modes (debug improve planex review security defensive ui) 530 ★
Skill Threat Modeling — Code-First Deep Risk Analysis Skill for Claude Code - 8-Phase Workflow with Security design review, STRIDE Thr 207 ★
Public Skills Builder — Generate Claude Code bug bounty skills from public HackerOne reports and GitHub writeups — 18 vuln classes, no 155 ★