security-research

by code-yeongyu70k

Install

Use withClaudeCursorCodex

The file stays in the publisher's repository. PlugMCP does not host or rewrite it.

Download skill .agents/skills/security-research/SKILL.md on GitHub

Related skills

View all

remove-deadcodeRemove unused code from this project with ultrawork mode, LSP-verified safety, atomic commits. Triggers: remove dead code, dead code, cleanup, remove unused.
work-with-prFull PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cub
senpi-qaQA the omo Senpi adapter (packages/omo-senpi, packages/senpi-task) against the REAL senpi binary in strict isolation, and write every artifact to the one canonical evidence path .omo/evidence/omo-senp

Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.

team_create({ inline_spec: { name: "security-research", description: "Parallel exploitability-driven security research team.", members: [ { name: "surface-hunter", kind: "category", category: "deep-low", prompt: "You map attack surface. Enumerate entry points, trust boundaries, attacker-controlled inputs, data sinks, privilege transitions, and sensitive assets. Return evidence with file paths and exact functions. Do not assign severity unless you can name an attack path." }, { name: "auth-data-hunter", kind: "category", category: "ultrabrain", prompt: "You hunt auth, authorization, tenant/data isolation, injection, SSRF, credential exposure, and confused-deputy flaws. Reason from attacker capability to impact. Return only findings with concrete exploit preconditions, CWE candidates, and verification steps." }, { name: "runtime-supply-hunter", kind: "category", category: "unspecified-high", prompt: "You hunt filesystem, subprocess, archive extraction, dependency, hook execution, MCP, config, and environment-variable risks. Check path traversal, command injection, unsafe downloads, permission boundaries, and supply-chain assumptions. Cite file paths and commands used." }, { name: "poc-engineer-a", kind: "category", category: "unspecified-high", prompt: "You build minimal safe PoCs for candidate findings. Use toy inputs and local-only execution. Your job is to prove or disprove exploitability, not to broaden scope. Report exact reproduction steps and expected output." }, { name: "poc-engineer-b", kind: "category", category: "deep-high", prompt: "You independently reproduce candidate findings and try to falsify them. Downgrade anything without a working path. If a PoC is unsafe to run, design a safe static or dry-run proof and explain the limit." } ] } })

Member	Kind	Category	Role
`surface-hunter`	category	`deep-low`	Map entry points, trust boundaries, and reachable attack surfaces.
`auth-data-hunter`	category	`ultrabrain`	Hunt auth, authorization, data isolation, injection, and secret handling flaws.
`runtime-supply-hunter`	category	`unspecified-high`	Hunt filesystem, subprocess, archive, dependency, hook, MCP, and config risks.
`poc-engineer-a`	category	`unspecified-high`	Build minimal PoCs for the strongest candidate findings.
`poc-engineer-b`	category	`deep-high`	Independently reproduce, falsify, or downgrade candidate findings.

security-research

Install

Related skills

Security Research - Team Mode Vulnerability Audit

Hard Preconditions

Severity Standard

Team Roster

Workflow

Phase 0: Scope and Baseline

Phase 1: Independent Hunter Pass

Phase 2: PoC Pass

Phase 3: Cross-Check

Phase 4: Final Report

Output Rules