cyber-neo

---

What is Cyber Neo?

Cyber Neo is a comprehensive cybersecurity analysis agent that runs inside Claude Code. Point it at any project on your computer, and it performs a deep security audit — scanning your code, dependencies, secrets, infrastructure, and supply chain for vulnerabilities. It generates a professional, prioritized report with actionable remediation guidance so you can fix issues before they become incidents.

No security expertise required. Just run /cyber-neo and let the agent do the work.

Cyber Neo was built with a mission: our community at tododeia.com is building apps, tools, and products. We want to help every developer in the community protect what they're building. This agent is our contribution — open source, free, and designed to be the most thorough security scanner available as a Claude Code skill.

---

Why Cyber Neo?

Most security tools require installation, configuration, and expertise to interpret results. Cyber Neo is different:

Traditional Security Tools	Cyber Neo
Require installation and setup	Works instantly as a Claude Code skill
Need security expertise to interpret	Plain-language findings with code-level remediation
Scan one category (SAST or SCA or secrets)	Scans 11 categories in one run
Output raw findings without context	CWE/OWASP-classified findings with fix examples
Run sequentially	5 parallel subagents for speed
Require paid licenses for full coverage	100% free and open source

---

What It Scans

Cyber Neo covers 11 security domains across every major vulnerability class:

#	Category	What It Finds	How
1	Code Security (SAST)	SQL injection, XSS, command injection, code injection, path traversal, SSRF, deserialization, prototype pollution	Semgrep (optional) + Claude-native pattern analysis
2	Authentication & Authorization	Missing auth middleware, JWT misconfigurations, broken access control, IDOR, session management flaws, missing RBAC	Claude-native analysis using auth-authz-patterns.md
3	Cryptographic Security	Weak algorithms (MD5, SHA1, DES, RC4), hardcoded keys/IVs, TLS bypass, insecure random, weak key lengths	Claude-native analysis using crypto-patterns.md
4	Secret Detection	60+ regex patterns: AWS, GCP, Azure, GitHub, Slack, Stripe, database credentials, private keys, API keys, JWT tokens, .env files	Python batch scanner + Gitleaks (optional)
5	Dependency Vulnerabilities (SCA)	Known CVEs in npm, pip, cargo, bundler, composer, and Go dependencies	Trivy / npm audit / pip-audit / cargo-audit (optional)
6	Web Security	Missing security headers (CSP, CORS, HSTS), CSRF, cookie flags, file upload flaws, open redirects	Claude-native analysis using web-security-patterns.md
7	Supply Chain Security	Lock file integrity, dependency confusion, typosquatting, unpinned versions, malicious packages	Python lockfile checker + Claude-native analysis
8	CI/CD Security	GitHub Actions script injection, overly permissive permissions, unpinned actions, secret exposure in workflows	Claude-native analysis using cicd-security.md
9	Docker & Container Security	Root user, unpinned base images, secrets in layers, privileged containers, Docker socket exposure	Claude-native analysis using iac-docker.md
10	Error Handling	Debug mode in production, stack trace exposure, empty catch blocks, missing error boundaries	Claude-native analysis using error-handling-patterns.md
11	Logging Security	Sensitive data in logs, log injection, missing security event logging	Claude-native analysis using logging-patterns.md

Standards Coverage

Cyber Neo maps every finding to industry standards: