UnboundCompute/security-agent-skills

What it claims

The repository packages security-testing method, not tooling. Its stated bet is that "a skill's value is judgment, not a script." Four rules recur across the skills: enumerate the whole taxonomy before examining one family, rank is triage and not a filter, a lead is a fact and never a verdict, and every skill opens with a scope check or gate for authorized work. The authorized cases it names are your own code, OSS you contribute to, CTFs and in-scope engagements.

How it works

Each skill carries a lane tag. Lanes include white-box, research, agent, supply-chain, black-box, cloud, iac, k8s, container, api, injection, deserialization, auth, identity, web-trust, web3, mobile, windows, payment, ai-app and reporting. A few skills act as hubs:

• hunting-bugs-with-a-code-graph is the white-box master loop: orient, enumerate the taxonomy, adjudicate.
• adjudicating-taint-paths turns a source-to-sink lead into either a confirmed finding or a documented kill.
• hunting-bug-variants and extracting-nday-from-a-patch take one bug or fix diff and look for its siblings.
• writing-vuln-reports takes schema-formatted findings from any skill and produces a reproducible writeup with no reformatting.

flowchart LR
  A[Any skill produces lead] --> B{Adjudicate}
  B -->|confirmed| C[Finding in shared schema]
  B -->|refuted| D[Documented kill]
  C --> E[writing-vuln-reports]

The white-box skills assume some way to answer structural questions from a real parse. That can be a code property graph, a static analyzer, or careful manual tracing on a small target.

The skills follow stated authoring conventions:

• gerund names;
• a description written as a routing rule (what, when, trigger terms, third person);
• a lean body with progressive disclosure;
• worked examples;
• a "rationalizations to reject" section in each skill.

Three skills address agent supply chain specifically. auditing-skill-and-mcp-instructions lints instruction text. auditing-declared-vs-used-permissions checks the gap between declared and used permissions. vetting-skills-before-install reaches an install, constrain or deny verdict for a third-party skill or MCP server.

How to use it

Install everything as a Claude Code plugin:

/plugin marketplace add UnboundCompute/security-agent-skills
/plugin install security-agent-skills@unboundcompute

Update with /plugin marketplace update unboundcompute. Skills are matched automatically by name and description.

Single skills can be copied instead:

# project-local (checked in with your repo)
cp -r skills/detecting-race-conditions .claude/skills/
# or personal (available in every project)
cp -r skills/detecting-race-conditions ~/.claude/skills/

Other Agent Skills runtimes can point at skills/. A SKILL.md can also be followed by hand. New contributions must keep the scope check, name capabilities rather than products, and emit the shared schema. CONTRIBUTING.md holds the checklist.

Limits

The README does not show the finding schema's fields. Coverage of the white-box skills depends on how well your parse-backed tooling answers structural queries. Several skills in the table overlap and appear to be parallel versions:

• testing-request-smuggling and hunting-http-request-smuggling-and-desync;
• auditing-jwt-verification-trust and auditing-jwt-verification-and-key-trust;
• auditing-saml-and-oidc-flows and auditing-saml-and-oidc-federation-trust;
• testing-web-cache-attacks and testing-web-cache-deception.

With automatic routing, these may compete for the same trigger.