coldtatooine

coldtatooine/vuln-skill-pack

Plugin Claude Code

Plugin marketplace listing 1 plugin: vun-skill-pack.

coldtatooine/vuln-skill-pack

Plugin Claude Code

Pre-launch security gate for MVPs. Secrets, auth holes, and stack footguns, then a BLOCK / WARN / GO verdict. Defensive review only.

coldtatooine/vuln-skill-pack

Hook Claude Code

Runs before the agent uses a tool for Read, Bash, Grep and Glob tool calls, running an inline shell check. From coldtatooine/vuln-skill-pack.

coldtatooine/vuln-skill-pack

Settings file Claude Code

Agent settings declaring 1 hook event (PreToolUse).

coldtatooine/vuln-skill-pack

Agent

Senior application security research agent for authorized defensive security review. Finds real, evidence-backed vulnerabilities using data-flow reasoning. Covers auth bypass, injection, SSRF, path traversal, secrets, crypto misuse, and AI/agent-specific issues. Avoids hallucinated findings and destructive actions.…

coldtatooine/vuln-skill-pack

Command

Format the current security finding into a structured report card with severity, CWE, root cause, evidence, impact, fix, and regression test. Pass --quick for a 3-line summary instead of the full card.

coldtatooine/vuln-skill-pack

Command

Apply the shortest credible fix for a confirmed security finding to the working tree, with a diff. Use after /scan, /vuln, /trace, or /finding when the team wants the issue resolved, not just reported.

coldtatooine/vuln-skill-pack

Command

Pre-launch security gate for MVPs. Fast checklist of the holes that kill a product on day one — leaked secrets, unauthenticated endpoints, permissive CORS, exposed debug, insecure defaults, known-vulnerable deps. Returns a BLOCK / WARN / GO verdict.

coldtatooine/vuln-skill-pack

Command

Shallow attack surface map of a path. Breadth before depth — entry points, trust boundaries, sensitive sinks, and top targets. Use before /scan.

coldtatooine/vuln-skill-pack

Command

Full security review of a file, directory, or project. Maps attack surface, prioritizes leads, traces data flows, and produces a structured findings report.

coldtatooine/vuln-skill-pack

Command

Dedicated secrets scan. Finds leaked API keys, tokens, passwords, and private keys across source, config, git history, and client bundles. The.

coldtatooine/vuln-skill-pack

Command

Fast, lightweight threat model for a new feature before you build it. Five-minute pass over what an attacker gains and where input must be validated. MVP-friendly — cheap up front, avoids expensive rework.

coldtatooine/vuln-skill-pack

Command

Follow one piece of untrusted input through the code from source to sink. Produces a hop-by-hop path with validation notes and a Vulnerable/Mitigated/Hypothesis verdict.

coldtatooine/vuln-skill-pack

Command

Turn a list of security findings into a launch decision for an MVP. Classifies each issue as blocks-launch, fix-this-week, or accept-documented-risk — a business call, not a generic severity list.

coldtatooine/vuln-skill-pack

Command

Scan for a specific vulnerability class across the codebase. Finds candidates, filters to reachable paths, verifies each, and reports confirmed issues in /finding format.

coldtatooine/vuln-skill-pack

Command

Input: optional scope (path/module) typed after the command; default to the whole project.

coldtatooine/vuln-skill-pack

Cursor rule

Next.js & Vercel security footguns — client/server secret leakage via NEXTPUBLIC, unauthenticated Server Actions and Route Handlers, middleware auth bypass, SSRF in server fetches. Apply when reviewing, building, or shipping a Next.js or Vercel app.

coldtatooine/vuln-skill-pack

Cursor rule

Node.js & Express API security footguns — missing auth/authz middleware, IDOR, broken JWT verification, permissive CORS, SQL/NoSQL/command injection, missing rate limiting, mass assignment. Apply when reviewing, building, or shipping a Node/Express (or Fastify/Koa/Nest) backend.

coldtatooine/vuln-skill-pack

Cursor rule

Core operating rules for defensive security review with the vun-skill-pack. Always in effect during any security analysis.

coldtatooine/vuln-skill-pack

Cursor rule

Stripe security footguns — unverified webhook signatures, trusting price/amount from the client, secret key exposure, missing idempotency, fulfilling on the wrong event. Apply when reviewing, building, or shipping payment or billing flows with Stripe.

coldtatooine/vuln-skill-pack

Cursor rule

Supabase security footguns — Row Level Security disabled or too permissive, servicerole key exposed to the client, weak policies, public storage buckets, client-set privilege columns. Apply when the app uses Supabase (Postgres, Auth, Storage, Edge Functions).

coldtatooine/vuln-skill-pack

Skill Claude CodeCodex

Use when reviewing, building, or shipping a Next.js or Vercel project. Footguns: NEXTPUBLIC secret leakage, unauthenticated Server Actions and Route Handlers, middleware auth bypass, SSRF, edge/CDN caching of auth responses.

coldtatooine/vuln-skill-pack

Skill Claude CodeCodex

Use when reviewing, building, or shipping a Node/Express (or Fastify/Koa/Nest) API. Footguns: missing authz, IDOR, broken JWT, permissive CORS, injection, mass assignment, proxy/cookie misconfig.

coldtatooine/vuln-skill-pack

Skill Claude CodeCodex

Use when deciding if a project is safe to deploy. Pre-launch security gate: secrets, unauthenticated endpoints, CORS, debug exposure, insecure defaults, vulnerable deps. Returns BLOCK / WARN / GO with file:line evidence.