Help us improve
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
By allsmog
Local-first vulnerability confirmation and remediation pipeline for Claude Code: context, x-ray, PASTA threat model, CVE threat-intel, SAST/taint, invariant testing, adversarial hunting, memory exploitability, fuzz proof, rule synthesis, SARIF, and PoC⁺ patch validation behind a hardened policy plane. Operates on source you have on disk, with no hosted service, live target, proxy, or traffic capture.
npx claudepluginhub allsmog/kuzushi-security-plugin --plugin kuzushi-security-pluginAdmin access level
Server config contains admin-level keywords
Executes bash commands
Hook triggers when Bash tool is used
Share bugs, ideas, or general feedback.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Config & container security review. For each scanned IaC candidate (Dockerfile / Kubernetes / Compose / Terraform), confirm whether it's a real misconfiguration in context — privileged containers, root, unpinned images, secrets in config, public network/storage, disabled TLS — and assign finding / candidate / rejected with file:line evidence and the secure setting. Read-only — promotes verdicts into .kuzushi/findings.json (source 'iac').
Check the CVE-derived invariants in .kuzushi/threat-intel.json against the code, per invariant, using the tree-sitter taint MCP tools (and codeql/joern if a DB/CPG exists). Decides hold / violated / needs-review with file:line evidence. Read-only.
Memory-corruption exploitability ASSESSMENT. For each memory-safety finding, work the analysis phases — vuln shape, control/offset plausibility, input constraints, mitigation posture — and assign an exploitability tier from a closed set + concrete remediation, with file:line evidence. Assessment only: never produces shellcode, ROP/JOP chains, mitigation bypasses, or any working hijack payload. Read-only; attaches an `exploitability` block onto .kuzushi/findings.json.
Concolic-lite path-constraint solving for hard-to-reach sinks. For a finding /verify left inconclusive, extract the guard/branch predicate between the attacker source and the sink (tree-sitter), then solve it into a concrete input that reaches the sink — using the concolic MCP backend (Z3 / CrossHair) when available, else reasoning it out (LLM). Read-only — attaches a `pathSolution` block; feeds /verify and /fuzz. Heuristic, not a proof.
Empirical proof-of-concept builder. For each finding /verify marked PoC-ready, synthesize the smallest harness that triggers the bug described in its verification pocSketch, written only under the provided harnessDir (never into application code). Records each harness's run command + expected signal; the poc-assemble host script runs it deterministically in a sandbox and classifies the crash. You build the harness — you do not run it.
Authorization-model review. Scans endpoints + object-access-by-id sites; the authz-reviewer agent finds missing authorization (CWE-862), IDOR / broken object-level authz (CWE-639), privilege escalation, and broken ownership, and promotes them into .kuzushi/findings.json (source "authz"). Complements /threat-hunt (which hunts named threats) with a dedicated authz pass.
Build the heavy semantic indexes the codeql/joern backends query — a CodeQL database (per detected language) and a Joern CPG — under .kuzushi/. Runs asynchronously in the background (doesn't block the session); installs the CLI first if missing. Pass "codeql" or "joern" to build just one.
Link related findings into higher-impact attack chains. The chain-finder agent reasons over the findings index for compositions (precondition → pivot → impact) — e.g. an auth bypass that turns a read-only SSRF into internal RCE — and records each chain with an ordered narrative + member fingerprints in .kuzushi/chains.json, attaching a `chains` ref onto each member finding (status unchanged). Needs ≥2 live findings.
Build a cached code-graph (.kuzushi/code-graph.json) — entry points + per-symbol caller counts (blast-radius / attack-surface signal) — so producers like /diff-review query it instead of re-deriving caller info live. Uses real Joern call edges when a CPG is built, else a deterministic ripgrep heuristic (no heavy tooling required). Re-run after large code changes.
Crypto-misuse review — non-constant-time comparison of secrets (timing side-channels), missing/compiler-elidable zeroization of secrets, and non-cryptographic RNG used to mint secrets. The crypto-reviewer agent confirms each candidate handles a secret and promotes real issues into .kuzushi/findings.json (source "crypto-review"). Distinct from /sast (injection) and /sharp-edges (API design).
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, and rules evolved over 10+ months of intensive daily use
Harness-native ECC plugin for engineering teams - 63 agents, 251 skills, 79 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Comprehensive .NET development skills for modern C#, ASP.NET, MAUI, Blazor, Aspire, EF Core, Native AOT, testing, security, performance optimization, CI/CD, and cloud-native applications
AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 27 skills, 8 autonomous agents. STRIDE threat modeling, hotspot-aware findings, SARIF output, and polyglot monorepo support.
AI-powered PASTA threat modeling plugin for Claude Code. Walks through the 7-stage Process for Attack Simulation and Threat Analysis with STRIDE classification, MITRE ATT&CK mapping, DFD generation, and evidence-anchored threat scenarios.
AI-first compliance assessment plugin for Claude Code. Runs prompt-orchestrated ISO 27001 Annex A and NIST SP 800-53 Rev 5 assessments with enterprise evidence packs, evidence-backed findings, cold review rounds, and durable run artifacts.
Modifies files
Hook triggers on file write and edit operations
Modifies files
Hook triggers on file write and edit operations
Uses power tools
Uses Bash, Write, or Edit tools
Uses power tools
Uses Bash, Write, or Edit tools
Share bugs, ideas, or general feedback.
Testing, security, and code quality experts - code review, penetration testing, QA automation
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security