perseus

Perseus Security Skills for Claude Code

Perseus is a comprehensive suite of interactive security assessment skills for Claude Code. It transforms Claude into an autonomous penetration testing partner for your own codebase, capable of performing everything from initial reconnaissance to deep-dive vulnerability research and executive reporting.

Defensive Security Testing: Perseus analyzes your own code to find vulnerabilities before attackers do. This is equivalent to running a security linter or static analyzer.

Features

Multi-Language Support (8 Languages)

Language	Frameworks
JavaScript/TypeScript	Express, Fastify, Next.js, Nest.js, Hono, Bun
Go	Gin, Echo, Fiber, Chi
PHP	Laravel, Symfony, Slim, Lumen
Python	FastAPI, Django, Flask, Starlette
Rust	Actix-web, Axum, Rocket, Warp
Java	Spring Boot, Quarkus, Micronaut
Ruby	Rails, Sinatra, Grape
C#	ASP.NET Core, Minimal APIs

Smart Auto-Detection

Perseus automatically detects your project's:

• Language & Framework (Next.js, Django, Spring, etc.)
• Database (PostgreSQL, MongoDB, Redis, etc.)
• Infrastructure (Docker, Kubernetes, AWS/GCP/Azure)
• CI/CD (GitHub Actions, GitLab CI, Jenkins)
• AI/LLM (OpenAI, Anthropic, LangChain)

Extended Coverage

• API Security: REST, GraphQL, WebSocket, gRPC, OAuth, Cache poisoning
• Injection: SQL, NoSQL, Command, SSTI, LDAP, XPath, Log4j
• Infrastructure: Docker, CI/CD, Cloud (AWS/GCP/Azure), Kubernetes
• AI Security: Prompt injection, RAG security, tool use validation
• Client-Side: React, Next.js SSR, Vue, Angular, Server Actions

---

Installation

Claude Code

/plugin install https://github.com/kaivyy/perseus

That's it! Everything is automatic:

• Skills and commands auto-discovered
• Hooks auto-registered
• Context injected on session start

Codex

git clone https://github.com/kaivyy/perseus.git ~/.codex/perseus
mkdir -p ~/.agents/skills
ln -sf ~/.codex/perseus/skills ~/.agents/skills/perseus

OpenCode

git clone https://github.com/kaivyy/perseus.git ~/.config/opencode/perseus && \
  mkdir -p ~/.config/opencode/plugins ~/.config/opencode/skills && \
  ln -sf ~/.config/opencode/perseus/.opencode/plugins/perseus.js ~/.config/opencode/plugins/perseus.js && \
  ln -sf ~/.config/opencode/perseus/skills ~/.config/opencode/skills/perseus

Uninstall

/plugin uninstall perseus

---

Quick Start

# Full automated assessment (with smart auto-detect)
/start

# Or run key steps manually
/scan        # Phase 1: Reconnaissance
/report      # Phase 4: Executive Report

# Optional: run all specialists
/specialist

---

Engagement Modes

Perseus uses explicit verification modes during assessment:

Mode	Environment	Verification Style
PRODUCTION_SAFE	Live production	Passive-first checks + minimal non-disruptive validation
STAGING_ACTIVE	Staging/pre-production	Active verification with strict throttling
LAB_FULL	Isolated lab	Broad dynamic verification
LAB_RED_TEAM	Dedicated security lab	Controlled adversarial chain simulation with kill-switches

Default mode is PRODUCTION_SAFE when environment is unclear.

---

Core Assessment Phases

Perseus follows a structured 4-phase methodology:

Phase 1: Scan (Reconnaissance)

Maps architecture, entry points, dependencies, and attack surface.

Command	Agents	Output
/scan	13 parallel agents	deliverables/code_analysis_deliverable.md

Coverage:

• Architecture & Tech Stack (auto-detect 8 languages)
• Entry Points (API, GraphQL, WebSocket, gRPC)
• Dependencies & CVEs
• Hardcoded Secrets
• Security Patterns (Auth, Authz)
• Injection Sinks & XSS Sinks
• SSRF & Data Flows
• Crypto Usage
• Security Headers & Config

Phase 2: Audit (Vulnerability Analysis)

Deep white-box analysis using Negative Analysis Loop (Source → Flow → Sink → Defense → Verdict).

Runs automatically after Scan during /start.

Wave 1: SQL Injection, Command Injection, XSS, Auth, Authz Wave 2: SSRF, Template Injection, Deserialization, Path Traversal, XXE Wave 3: JWT, Crypto, Race Conditions, Business Logic

Phase 3: Exploit (Verification)

Verify findings with mode-aware safe Proof-of-Concept payloads.

Runs automatically after Audit during /start.

Safe Payloads Only:

• SQL: SLEEP(5), AND 1=1
• Command: sleep 5, whoami
• XSS: alert(1), alert(document.domain)
• SSTI: {{7*7}} → 49

Phase 4: Report (Executive Summary)

Synthesize all findings into professional security report.

Command	Output
/report	deliverables/SECURITY_REPORT.md