Oh My Secuaudit

oh-my-secuaudit

Security skill collection for Claude Code and Codex workflows.

Install (Claude Code)

This repo is packaged as a Claude Code plugin marketplace named `windshock`. The plugin name is `oh-my-secuaudit`.

/plugin marketplace add windshock/oh-my-secuaudit
/plugin install oh-my-secuaudit@windshock

To develop locally against this checkout:

/plugin marketplace add /Users//path/to/oh-my-secuaudit
/plugin install oh-my-secuaudit@windshock

After install, the six SKILL.md files become discoverable to Claude Code by their frontmatter `description` and trigger automatically when relevant work appears.

Layout

Skills live under `plugins/oh-my-secuaudit/skills/` (Claude Code plugin convention: `/skills//SKILL.md`). Category groupings (architect / runtime / static / external / methodology) live in this README, not in directory paths.

• plugins/oh-my-secuaudit/skills/sec-audit-static (static): SAST/SCA/secret/reporting workflow
• plugins/oh-my-secuaudit/skills/sec-cluster (static): security code clustering workflow (v4 dataflow-based)
• plugins/oh-my-secuaudit/skills/sec-audit-dast (runtime): runtime/API assessment workflow (DAST/ASM)
• plugins/oh-my-secuaudit/skills/external-software-analysis (external): third-party software/binary analysis workflow
• plugins/oh-my-secuaudit/skills/security-architecture-review (architect): security architecture review workflow
• plugins/oh-my-secuaudit/skills/security-testing-as-code (methodology): assessment-as-project workflow (PoC, evidence, handoff)

Capability Matrix

Skill	Primary Question	Typical Input	Primary Output	Consumed By
sec-audit-static	What is vulnerable in source code and dependencies?	source repo	finding JSON, task/final report JSON, markdown report, reporting_summary	security-architecture-review
sec-cluster	Which code paths share the same security review strategy?	sou