Agent
INTERNAL — dispatched on request when APPSECPLUGINDEV=1, either from the offer after a create-threat-model run's completion summary or from /appsec-advisor:diagnose-run. Reads the deterministic .run-issues.json, decides per issue whether the symptom is a defect in this plugin or an environment/expected condition, and…
Agent
INTERNAL specialist for the Stage-2 Security Architecture fragment. Authors only evidence-grounded prose in security-architecture.md; the controller owns composition and shared stage state.
Agent
INTERNAL context-v2 — bounded STRIDE for one component.
Agent
INTERNAL — controller-dispatched STRIDE fan-in reviewer for bounded merge candidates; emits merge, keep, or consolidate decisions without performing STRIDE analysis.
Agent
INTERNAL renderer for Stage 2 of create-threat-model. Invoke only from the skill after Stage 1 has produced validated intermediate artifacts.
Agent
INTERNAL — controller-dispatched cross-component threat triage; validates rating consistency and prioritization, writes .triage-flags.json, and annotates .threats-merged.json.
Agent
INTERNAL — dedicated Stage-1b analyst. Assesses deterministic crossing signals in a fresh context and writes only untrusted trust-boundary candidates and explicit signal dispositions.
Hook
Runs when a session starts on startup, executing session_banner.py via python3. From appsec-foundry/appsec-advisor.
Hook
Runs when you submit a prompt, before the agent sees it, executing security_steering.py via python3. From appsec-foundry/appsec-advisor.
Hook
Runs to expand your prompt before the agent sees it, executing skill_policy_gate.py via python3. From appsec-foundry/appsec-advisor.
Hook
Runs after a tool call finishes, executing agent_logger.py via python3. From appsec-foundry/appsec-advisor.
Hook
Runs when the agent finishes a response, executing agent_logger.py via python3. From appsec-foundry/appsec-advisor.
Hook
Runs when a subagent starts, executing agent_logger.py via python3. From appsec-foundry/appsec-advisor.
Hook
Runs when a subagent finishes, executing agent_logger.py via python3. From appsec-foundry/appsec-advisor.
Skill Claude CodeCodex
Answer ANY question about the threat model in this repo — read-only Q&A over the committed threat-model.yaml. The default surface for every natural-language query about the model, however simple: does one exist at all ("is there a threat model here?", "gibt es hier ein bedrohungsmodell?"), how it stands ("how bad is…
Skill Claude CodeCodex
Audit the current repository against a security requirements catalog and verify whether each requirement is implemented. Requirement IDs follow your catalog's own naming scheme (e.g. SEC-CSP-1, SCG-HARDENXML, or anything your YAML defines); tagging code with those IDs is optional and not required. Prints open…
Skill Claude CodeCodex
Standalone AuthN/AuthZ review of any repository. Runs three deterministic Python scanners (route inventory, auth-check scanner, IDOR confirmer) and dispatches a specialized agent that reasons over the combined output: cross-component IDOR chains, RBAC coverage gaps, JWT misconfiguration, and privilege-escalation…
Skill Claude CodeCodex
Preflight the Claude Code permission allow-list for the AppSec plugin. Reports which Bash/Write/Edit/Read rules from data/required-permissions.yaml are missing from the user's settings.json, so unattended /appsec-advisor:create-threat-model runs do not block on prompts. Read-only by default; --update merges missing…
Skill Claude CodeCodex
Remove stale run-state files left behind by a crashed or abruptly terminated threat-model assessment. Refuses to clean when an active run is still holding the lock. Use when the Claude Code UI shows the threat-modeling skill as "scanning" forever after a session crash.
Skill Claude CodeCodex
Perform a threat assessment of a repository and produce a threat-model.md. Supports --repo to analyze external repos and --output to set the output directory. Use --requirements to check the findings against a security requirements catalog; no separate setup command is needed for that. Optionally also writes…
Skill Claude CodeCodex
Maintainer/dev skill that triages an anonymised diagnostic bundle (appsec-diag-.tgz, produced by scripts/diagnosticbundle.py) a user sent after a pipeline failure. Runs the deterministic inspect, then cross-references the plugin source (scripts/, compact runtimes, agents/, AGENTS.md) and known-bug history to produce a…
Skill Claude CodeCodex
Find the plugin defects behind the issues a create-threat-model run recorded. Reads .run-issues.json, re-reads each symptom next to the plugin's own code, and reports a file:line root cause per issue, or classifies it as an environment or expected condition. Read-only against the plugin; writes only .run-bugs.json.…
Skill Claude CodeCodex
Developer/test skill that grades the SEMANTIC quality of a produced threat model (plausibility, severity proportionality, STRIDE coverage, mitigation actionability, missed surfaces) via a find→adversarial-verify loop over a frozen run. Complements the structural pytest/qachecks suite; does NOT re-run the pipeline.
Skill Claude CodeCodex
Re-export a finished threat-model.yaml/.md into PDF + HTML + SARIF + pentest-tasks artifacts, or the alpha OWASP Threat Dragon / ThreatAtlas JSON. Standalone post-processing — does not analyze the repo, does not run any agent. SARIF, pentest-tasks and Threat Dragon are derived deterministically from threat-model.yaml…