Security Harness

A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README / JSON / SARIF / doc / PDF.

Scope: this harness performs static analysis (source review, data-flow tracing, PoC/payload construction) on code you own or are authorized to test. It does not attack live third-party systems.

What's inside

security-harness/                         # a plugin marketplace
└── plugins/security-harness/
    ├── skills/
    │   ├── sh-router            # single entry point - routes any appsec request
    │   ├── sh-security-review   # the pipeline orchestrator (Stages 0-5)
    │   └── sh-kb-*  (15)        # per-vuln-class knowledge bases
    ├── agents/
    │   ├── sh-recon             # map: Graft graph + stack/SBOM/CVE + attack surface
    │   ├── sh-hunter            # find: source→sink hunting, one per class (parallel)
    │   ├── sh-chainer           # escalate: combine findings into attack chains
    │   ├── sh-verifier          # confirm: offensive + seceng + dev verification + PoC
    │   └── sh-reporter          # deliver: README/JSON/SARIF/HTML/PDF/doc
    └── references/              # shared contracts (finding schema, SARIF map, state files, rubrics)

Vulnerability classes covered (the sh-kb-* skills)

access-control (IDOR/BOLA/priv-esc) · sqli · xss · ssrf · injection (cmd/code/SSTI/LDAP) · auth (session/JWT) · deserialization · path-traversal (LFI/RFI) · secrets · csrf · xxe · open-redirect · crypto · race-conditions · file-upload. Dependency CVEs/SBOM are handled by the recon stage.

Install

The harness ships for several agents. Full packaging details and the release checklist are in docs/DISTRIBUTION.md.

Claude Code - add this repo as a plugin marketplace and install the plugin:

/plugin marketplace add dmdhrumilmistry/security-harness
/plugin install security-harness

/plugin marketplace add accepts any of: a GitHub owner/repo (as above), a full git URL (https://github.com/dmdhrumilmistry/security-harness.git), or a local path to a clone (e.g. /plugin marketplace add ./security-harness from the directory containing your checkout). Then run /plugin install security-harness and reload when prompted.

Gemini CLI - a native extension, manifest at the repo root:

gemini extensions install https://github.com/dmdhrumilmistry/security-harness

opencode, Codex, or any agentskills.io agent - copy the skills into a discovery directory. Codex additionally picks up AGENTS.md on its own:

git clone https://github.com/dmdhrumilmistry/security-harness
cd security-harness
python3 scripts/sync-agent-skills.py --install agents     # ~/.agents/skills
python3 scripts/sync-agent-skills.py --install opencode   # ~/.config/opencode/skills