agentic-security

agentic-security

Build faster with an
Agentic Workforce.
Safe, secure, and compliant
is now the default.

Built by Clear Capabilities.

---

What you get

─────────────────────────────────────────────────────────────────
  ❌  Not safe to deploy  ·  api-billing
─────────────────────────────────────────────────────────────────
   3 critical · 8 high · 22 medium · 41 advisory
   🔥 2 actively exploited in the wild (CISA KEV)
   ✓  1 CONFIRMED (PoC built by /triage --validate)

   [critical] SQL Injection                api/users.ts:42
     Could leak PII for ~5,000 users.
     Estimated cost if exploited: $125k–$1.3M
     Fix:  use parameterized query — db.query('SELECT * FROM users WHERE id = ?', [id])

   [critical] Hardcoded Stripe live key    src/lib/billing.ts:7
     Could enable fraudulent charges against your account.
     Estimated cost if exploited: $50k–$500k (chargebacks + Stripe fees)
     Fix:  rotate via /agentic-security:fix --rotate-secret --auto, then move to env var

   [critical] Missing webhook signature    api/stripe-webhook.ts:12
     Anyone can POST a fake "payment.succeeded" and unlock paid features.
     Estimated cost if exploited: cost of a free subscription × every attacker
     Fix:  stripe.webhooks.constructEvent(rawBody, signature, endpointSecret)

   How many do you want to fix?
     1. Critical only           (3 fixes)
     2. Critical + High         (11 fixes)
     3. Critical + High + Medium (33 fixes)
─────────────────────────────────────────────────────────────────

No CVE jargon. The stakes, the cost, the fix.

---

Install

In Claude Code (recommended) — two steps:

/plugin marketplace add https://github.com/Clear-Capabilities/agentic-security
/plugin install agentic-security@clearcapabilities

The first command registers the marketplace as a source; the second actually installs the plugin. Then restart Claude Code (or /reload-plugins). To update later: /plugin marketplace update clearcapabilities followed by /plugin install agentic-security@clearcapabilities.

In your terminal (no Claude Code required):

npx @clear-capabilities/agentic-security-scanner secure .

Also works with Codex, Cursor, and Gemini CLI — harness setup.

---

Ten commands

/agentic-security:secure — Router. Picks the single best next action from project state. Also: --tour, --help, --daily.

/agentic-security:find-and-fix-everything — One-shot scan + fix every severity in one command. The vibecoder "just make it safe" path.

/agentic-security:scan — Run the scanner. Modes: full / diff / watch / baseline / archaeology / scanner-meta.

/agentic-security:triage — Decide on findings. Modes: id / show / explain / validate / tournament / red-team / exploit / query.

/agentic-security:fix — Remediation. Modes: id / all / pr / sca / compliance / rotate-secret / vault / harden / trim / generate.

/agentic-security:posture — Posture + reporting. Modes: status / report-card / harness / trend / threat / playbook / mgmt.

/agentic-security:compliance — Compliance + auditor flows. Modes: report / walkthrough / attestation / audit / pr.

/agentic-security:supply — Supply chain. Modes: check / sbom / cve-alerts / license.

/agentic-security:setup — Workflow installers + guards. Modes: hooks / ci / bodyguard / destructive-guard.

/agentic-security:labs — Experimental + AI-driven. Modes: claude-audit / model-rescan / synthesize-rule / cross-repo / risk-dollars / time-to-fix / llm.

Every legacy capability is reachable as a mode of one of these dispatchers — run /secure --help for the full surface.

---

Compliance frameworks

/compliance --report <framework> generates an auditor-ready attestation that scans your project against:

Framework	<framework>	Coverage map
NIST AI 600-1 (2024) — Generative AI Profile	nist	coverage
OWASP ASVS 4.0.3 — Application Security Verification Standard	asvs	coverage
OWASP LLM Top 10 (2025)	llm	coverage
EU AI Act	eu-ai-act	scripts/eu-ai-act/