windshock

Oh My Secuaudit — Security skill for Claude Code

Security community

Security skill collection for Claude Code and Codex — SAST, DAST, binary analysis, architecture review, code clustering, and assessment-as-code workflows.

How to install Oh My Secuaudit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open windshock/oh-my-secuaudit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Oh My Secuaudit does

Security skill collection for Claude Code and Codex — SAST, DAST, binary analysis, architecture review, code clustering, and assessment-as-code workflows.

Alternatives in Security

FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
Skill Code Review — Expert multi-AI code review with inline PR comments — use for thorough quality and security analysis 2.8k ★
Dotclaude — A comprehensive development environment with specialized AI agents for code review, security analysis, and tec 435 ★

README

oh-my-secuaudit

Security skill collection for Claude Code and Codex workflows.

Install (Claude Code)

This repo is packaged as a Claude Code plugin marketplace named `windshock`. The plugin name is `oh-my-secuaudit`.

/plugin marketplace add windshock/oh-my-secuaudit
/plugin install oh-my-secuaudit@windshock

To develop locally against this checkout:

/plugin marketplace add /Users//path/to/oh-my-secuaudit
/plugin install oh-my-secuaudit@windshock

After install, the six SKILL.md files become discoverable to Claude Code by their frontmatter `description` and trigger automatically when relevant work appears.

Layout

Skills live under `plugins/oh-my-secuaudit/skills/` (Claude Code plugin convention: `/skills//SKILL.md`). Category groupings (architect / runtime / static / external / methodology) live in this README, not in directory paths.

plugins/oh-my-secuaudit/skills/sec-audit-static (static): SAST/SCA/secret/reporting workflow
plugins/oh-my-secuaudit/skills/sec-cluster (static): security code clustering workflow (v4 dataflow-based)
plugins/oh-my-secuaudit/skills/sec-audit-dast (runtime): runtime/API assessment workflow (DAST/ASM)
plugins/oh-my-secuaudit/skills/external-software-analysis (external): third-party software/binary analysis workflow
plugins/oh-my-secuaudit/skills/security-architecture-review (architect): security architecture review workflow
plugins/oh-my-secuaudit/skills/security-testing-as-code (methodology): assessment-as-project workflow (PoC, evidence, handoff)

Capability Matrix

Skill	Primary Question	Typical Input	Primary Output	Consumed By
`sec-audit-static`	What is vulnerable in source code and dependencies?	source repo	finding JSON, task/final report JSON, markdown report, `reporting_summary`	`security-architecture-review`
`sec-cluster`	Which code paths share the same security review strategy?	sou