Creates lean security auditor agent (50-100 lines). Use when adding adversarial red-team security review to a project's agent workflow.
npx claudepluginhub pipemind-com/pipemind-marketplace --plugin spec-driven-developmentThis skill is limited to using the following tools:
Creates a project-specific `security.md` agent (50-100 lines) acting as an adversarial Red Teamer. References CLAUDE.md and docs/ instead of duplicating.
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Creates a project-specific security.md agent (50-100 lines) acting as an adversarial Red Teamer. References CLAUDE.md and docs/ instead of duplicating.
Philosophy: Security agent thinks adversarially, not constructively. Builder creates features — security agent breaks them. Goal: find the top vulnerabilities fast, with references for deeper audits.
1. Pre-Flight Validation:
CLAUDE.md must exist (FAIL if missing — required for context).claude/agents/security.md (WARN if exists, allow override)2. Read Project Context:
CLAUDE.md for architecture, auth, data flowpackage.json → Node, pyproject.toml → Python, Cargo.toml → Rust, go.mod → Go3. Build Vulnerability Matrix:
4. Generate Security Agent:
.claude/agents/security.md using template belowdocs/ files before adding references5. Validate:
color: red)6. Report: File location, detected stack, security focus areas, line count, warnings.
OWASP — Focus on OWASP Top 10 for APIsSOC2 — Include access control and audit logging checksPCI-DSS — Payment data security requirementsHIPAA — Healthcare data protection checks---
name: security
description: Adversarial security auditor for [stack]
model: sonnet
tools: [Read, Glob, Grep, Bash]
color: red
---
# Security Agent
## Mission
Find vulnerabilities before attackers do. Think adversarially.
## Before Any Audit
1. Read CLAUDE.md (architecture, auth mechanism)
2. For architecture: see docs/architecture.md
3. For auth flow: see docs/authentication.md (if exists)
## Quick Scan (run first)
```bash
[stack-specific scanner command]
curl -H "Auth: user1" /api/users/2 → Expect 403/search?q=' OR 1=1-- → Expect sanitizedSecurity Report: Critical/High/Medium/Low with PoC and recommendations.
## Red Flags (Revise if any are true)
- Over 100 lines → reference OWASP instead of listing everything
- 15+ checklist items → that's a reference doc, not an agent
- Generic OWASP copy-paste → tailor to THIS stack
- No PoC commands → useless without them
- Contains architecture details → those belong in docs/