kulchankas

Hack Me — Security skill for Claude Code

Security community

Attack your own running app on localhost, prove each vuln is real, patch it, and re-verify.

How to install Hack Me

Installs to ~/.claude/skills/kulchankas-paranoid-hack-me/SKILL.md

Terminal
mkdir -p ~/.claude/skills/kulchankas-paranoid-hack-me && curl -fsSL https://raw.githubusercontent.com/kulchankas/paranoid/HEAD/commands/hack-me.md -o ~/.claude/skills/kulchankas-paranoid-hack-me/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Hack Me does

description: Attack your own running app on localhost, prove each vuln is real, patch it, and re-verify.

/hack-me

Turn the `paranoid` review into proof. Instead of *telling* the user their code has an IDOR, you demonstrate it against their own app on localhost, then fix it and show the exploit now fails.

Scope — read first, enforce always

This runs **only** against an app the user owns and is running locally. Before touching anything:

  • Target must be local. localhost, `1

Alternatives in Security

  • Maestro Odyssey — Long-running iterative cycle — one entry, seven modes (debug improve planex review security defensive ui) 530 ★
  • Skill Threat Modeling — Code-First Deep Risk Analysis Skill for Claude Code - 8-Phase Workflow with Security design review, STRIDE Thr 207 ★
  • Public Skills Builder — Generate Claude Code bug bounty skills from public HackerOne reports and GitHub writeups — 18 vuln classes, no 155 ★

Full documentation available on GitHub

View Source Repository

Related Skills

Hunt — Security skill for Claude Code

Hunt

Start hunting on a target — loads scope, reads disclosed reports, picks best attack surface based on tech stac

Security community
AI Driven Attack Defense — Security skill for Claude Code

AI Driven Attack Defense

Defending against attackers who use AI - phishing, voice/video deepfakes, automated vuln discovery, adaptive m

Security community
Citecheck — Security skill for Claude Code

Citecheck

Audit every legal citation in a draft: extract deterministically, prove each authority exists, then verify it

Security community
Goalpost — Security skill for Claude Code

Goalpost

Your agent says “All tests pass!” The hidden tests say 28/34. goalpost makes Claude Code's /goal prove it: fro

Security community
Audit Scopes — Security skill for Claude Code

Audit Scopes

Audit and minimize API scopes for security, verify scope usage, and generate scope justification for App Store

Security community
AdTech LeadGen Agent Skills — Security skill for Claude Code

AdTech LeadGen Agent Skills

🎯 Schema-validated Agent Skills for AdTech lead generation and publisher compliance: audit ads.txt/app-ads.tx

Security community

Related Agents

Infra Vuln Management — Security agent for Claude Code

Infra Vuln Management

CVE prioritization and patch sequencing. Mostly mechanical lookups against your inventory. Peer to infra-secur

Security community
Vuln Recon — Security agent for Claude Code

Vuln Recon

Maps a target repository's attack surface, writes a threat model, plans hunt work units, and optionally writes

Security community
Webtester — Development agent for Claude Code

Webtester

Use this agent to verify that a web app actually works end-to-end in a real browser, driven by Playwright agai

Development community