appsec-foundry

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Identify and apply fixes for issues recorded by the previous create-threat-model run. Auto-applies safe fixes with confirmation; prints manual-review guidance for everything else.

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Show what this plugin can do and which entry point fits the task — the starting point when someone does not know the commands yet ("what can appsec-advisor do?", "which commands are there?", "how do I start?", "wie fange ich an?", "was kann das plugin?", "help"). Prints a short command reference with example calls…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Install the secure-coding baseline into Claude Code's instruction files, so the coding rules are in context on every prompt instead of only the ones that mention security. Menu-driven: this machine (/.claude/CLAUDE.md), this repository (project CLAUDE.md), or this repository without touching CLAUDE.md…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

INTERNAL shared invariants preloaded only into appsec-advisor threat-analysis agents; not a user-invocable workflow.

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Publish a completed threat model to version control. Runs pre-flight security checks (repo visibility, secret scan), patches .gitignore with negation exceptions for the publishable files, and creates a signed git commit with threat-count metadata. Keeps pentest-tasks.yaml and all intermediate files permanently ignored.

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Remove an installed secure-coding baseline from Claude Code's instruction files, so the rules stop loading at the next session start. Drops the import by default and leaves the file on disk; deleting the file is a separate step that is always confirmed first, because the plugin cannot tell a copy it wrote from one the…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

User-facing skill for reporting a pipeline error. Builds an anonymised diagnostic bundle (appsec-diag-.tgz) from the failed run via scripts/diagnosticbundle.py, shows the user exactly what it contains, and tells them to review it and attach it to a GitHub issue. The bundle carries only tool versions, run shape, and…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

User-facing triage of an existing threat model — an overview-first console over an already-generated threat-model.yaml (backlog by priority, severity mix, worst-case scenarios), then one of three modes. "Just look around" browses findings read-only by severity, security aspect, requirement, or control posture. "Fix or…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Deterministic quick Security Score (0-100) for a repository, computed from the scanner layer alone — no agents, no LLM, no threat model, nothing written into the target repository. Reports the score together with how many rules applied, the finding tally, and the weakest control domains. Use for a fast indication or a…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Write the required Claude Code permission allow-list into a target repository so that /appsec-advisor:create-threat-model runs without permission prompts. One-shot setup; idempotent.

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Print the standard summary block of the current threat model — scan identity, findings by severity, the remediation backlog (P1/P2/P3) and mitigation coverage, the worst-case scenarios, control posture, and whether the model is still up to date. A DISPLAY command, not a question-answering surface: use it only for an…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Read-only overview of the AppSec plugin — version, available features, last-run identity, and configuration sources. Does not analyze or modify anything.

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Read-only three-check health probe for the threat model. Checks (1) whether a threat model exists and is still current, (2) whether intermediate artifacts are present and should be cleaned up, and (3) whether a threat model assessment is currently running. Check 3 runs first; if a run is active checks 1 and 2 are…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Reports that incremental threat-model updates are unavailable in the compact runtime and directs the user to a full or rebuild assessment.

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Read-only check of whether the secure-coding baseline is actually loaded into Claude Code's instructions — which id, from which scope, through which file. Walks the project CLAUDE.md, .claude/CLAUDE.md, CLAUDE.local.md, .claude/rules/ and /.claude/CLAUDE.md plus their @ imports. Reports rather than fails; --enforce…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Help a developer check the code they just changed against their company security requirements — or, if none are configured, against a built-in best-practices baseline. Scopes to the current diff, dispatches the appsec-reviewer subagent to grade only the triggered requirements, and prints concrete, code-aware guidance…

appsec-foundry/appsec-advisor

Skill Claude CodeCodex

Refresh an already-installed secure-coding baseline from the source that publishes it, in place, wherever it is loaded from — this machine, the repository, or a file the repository already carried. Reports when the published baseline has moved to a new id, which arrives with a plugin release rather than with this…