From security-research
Run additional security audit passes that build on previous work. Reads all existing findings, attack surfaces, and coverage data to identify gaps, generate new hunting hypotheses, and focus on unexplored areas. Maintains a coverage tracker across runs for stateful optimization. Use after an initial audit to find vulnerabilities missed in earlier passes.
npx claudepluginhub pucagit/claude-plugin --plugin security-researchThis skill uses the workspace's default tool permissions.
Not every vulnerability can be found in a single audit pass. This skill runs additional focused passes that build on previous work — covering remaining attack surfaces, discovering new ones from confirmed findings, and hunting for vulnerabilities that require different perspectives or deeper analysis.
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Not every vulnerability can be found in a single audit pass. This skill runs additional focused passes that build on previous work — covering remaining attack surfaces, discovering new ones from confirmed findings, and hunting for vulnerabilities that require different perspectives or deeper analysis.
security_audit/recon/ has intelligence.md, architecture.md, attack-surface.mdsecurity_audit/findings/ may contain existing VULN-NNN/ directoriesRead ALL existing audit artifacts to understand what's been done:
# Read workspace config
cat ${PROJECT_DIR}/CLAUDE.md
# Read recon artifacts
cat ${AUDIT_DIR}/recon/intelligence.md
cat ${AUDIT_DIR}/recon/architecture.md
cat ${AUDIT_DIR}/recon/attack-surface.md
cat ${AUDIT_DIR}/recon/variant-analysis.md 2>/dev/null
cat ${AUDIT_DIR}/recon/web_intelligence.md 2>/dev/null
# Read existing findings
ls ${AUDIT_DIR}/findings/VULN-*/VULN-*.md 2>/dev/null
# Read each finding's metadata (Status, Severity, CWE, Location)
# Read false positives
cat ${AUDIT_DIR}/false-positives.md 2>/dev/null
# Read scan candidates
cat ${AUDIT_DIR}/logs/scan-candidates.md 2>/dev/null
# Read coverage tracker if exists (from previous iterative runs)
cat ${AUDIT_DIR}/recon/coverage-tracker.md 2>/dev/null
# Read learned techniques (new since last run)
for skill in detect-injection detect-auth detect-logic detect-config deep-dive variant-analysis; do
cat skills/${skill}/references/cool_techniques.md 2>/dev/null
done
If {AUDIT_DIR}/recon/coverage-tracker.md doesn't exist, create it by analyzing the current state:
# Audit Coverage Tracker
## Run History
| Run | Date | Findings | New Attack Surfaces | Focus Areas |
|-----|------|----------|-------------------|-------------|
| 1 (initial) | {date from orchestrator.log} | {count from findings/} | {count from attack-surface.md} | Full audit |
## Explored Modules
| Module | Run # | Findings | Technique Used | Notes |
|--------|-------|----------|----------------|-------|
[Populate from existing findings — which files were analyzed, what was found]
## Unexplored Modules
| Module | Priority | Reason for Priority |
|--------|----------|-------------------|
[Identify modules from architecture.md NOT appearing in any finding or deep-dive]
## Hunting Hypotheses (Status)
[Copy hypotheses from attack-surface.md, mark each as tested/untested based on findings]
- [x] {hypothesis} — tested in run 1, result: {VULN-NNN / no finding}
- [ ] {hypothesis} — NOT tested yet
If coverage-tracker.md already exists, read it and proceed to Step 3.
Identify what was missed or underexplored:
Compare architecture.md endpoint inventory and attack-surface.md Critical Module Ranking against findings/ and coverage-tracker.md:
Review Hunting Hypotheses from attack-surface.md:
For each CONFIRMED finding from previous runs:
Previous findings may reveal NEW attack surfaces not in the original recon:
references/cool_techniques.md since the last run?Create a focused plan for this run:
ITERATIVE AUDIT — RUN #{N}
══════════════════════════════════════════
Previous runs: {N-1}
Previous findings: {count} ({confirmed}C, {fp}FP)
Coverage: {explored}/{total} high-priority modules
This run will focus on:
1. UNEXPLORED MODULES ({count}):
- {module_path} — Priority: HIGH — Reason: {why}
- {module_path} — Priority: MEDIUM — Reason: {why}
2. UNTESTED HYPOTHESES ({count}):
- {hypothesis} — from attack-surface.md
- {hypothesis} — from scan-candidates.md
3. VARIANT EXPANSION ({count}):
- Expand VULN-{NNN} pattern to {N} candidate files
- Cross-module chain: VULN-{A} + VULN-{B}
4. NEW TECHNIQUES TO APPLY ({count}):
- {technique} on {module} — learned {date}
5. FRESH PERSPECTIVE:
- {new angle not tried in previous runs}
Estimated new findings: {low}-{high}
══════════════════════════════════════════
Approve this plan to begin, or tell me what to change.
HARD GATE — Do NOT proceed until the user approves.
For each item in the approved plan:
For each finding, self-verify inline: invoke skill="verify-finding" before writing.
After completing the run, update {AUDIT_DIR}/recon/coverage-tracker.md:
ITERATIVE AUDIT — RUN #{N} COMPLETE
══════════════════════════════════════════
New findings this run: {count}
By severity: {critical}C / {high}H / {medium}M / {low}L
Variants expanded: {count}
Chains discovered: {count}
Cumulative totals:
Total findings: {total}
Total confirmed: {confirmed}
Total false positives: {fp}
Coverage update:
Modules explored: {explored}/{total} ({percentage}%)
Hypotheses tested: {tested}/{total} ({percentage}%)
Remaining high-priority gaps: {count}
Recommendation:
{CONTINUE — {N} high-priority gaps remain, estimated {M} more findings}
or
{WRAP UP — coverage is comprehensive, diminishing returns expected}
Next steps:
- /security-research:iterative-audit → Run another pass
- /security-research:verify-finding → Re-verify or execute PoCs
- /security-research:write-report → Generate report with all findings
- /security-research:capture-technique → Capture successful techniques
══════════════════════════════════════════
Recommend wrapping up when:
Recommend continuing when: