naporin0624/claude-web-audit-plugins
Agent
CVE specialist bounty hunter. Obsessed with known vulnerabilities and public exploits. Every outdated library is a potential $5,000-$50,000 payday. Use when hunting specifically for known CVE vulnerabilities in web stacks.
naporin0624/claude-web-audit-plugins
Agent
Secret detection specialist. Hunts for hardcoded credentials, API keys, tokens, and private keys in git repositories. Every exposed secret is a potential $1,000-$50,000+ finding. Use when scanning for secrets, credentials, or sensitive data in codebases.
naporin0624/claude-web-audit-plugins
Agent
Dockerfile security and best practices specialist using Hadolint. Analyzes Dockerfiles for security issues, best practice violations, and configuration problems. Use when reviewing Dockerfiles, container builds, or CI/CD pipeline security.
naporin0624/claude-web-audit-plugins
Agent
IDOR specialist bounty hunter. Master of finding insecure direct object references. Every numeric ID is a potential $2,000-$50,000 payday. Use when hunting specifically for authorization bypass and IDOR vulnerabilities.
naporin0624/claude-web-audit-plugins
Agent
SAST specialist using Semgrep. Hunts for code-level vulnerabilities including injection flaws, XSS, insecure deserialization, and security anti-patterns. Use when performing static analysis, code security review, or hunting for OWASP Top 10 vulnerabilities in source code.
naporin0624/claude-web-audit-plugins
Agent
SQL Injection specialist bounty hunter. Lives for database errors and UNION selects. Every login form is a potential $5,000-$50,000 payday. Use when hunting specifically for SQL injection vulnerabilities.
naporin0624/claude-web-audit-plugins
Agent
Infrastructure as Code security specialist using tfsec and Checkov. Hunts for cloud misconfigurations in Terraform, CloudFormation, and Kubernetes manifests. Use when reviewing IaC, Terraform plans, or cloud infrastructure security.
naporin0624/claude-web-audit-plugins
Agent
Container and dependency security specialist using Trivy. Scans container images for OS and library vulnerabilities, and filesystems for dependency vulnerabilities. Use when scanning Docker images, container registries, or performing SCA on codebases.
naporin0624/claude-web-audit-plugins
Agent
XSS specialist bounty hunter. Obsessed with finding script injection, event handlers, and DOM manipulation vulnerabilities. Every reflected input is a potential $500-$15,000 payday. Use when hunting specifically for XSS vulnerabilities in web applications.
naporin0624/claude-web-audit-plugins
Command
Run accessibility and HTML lint audit on files, then provide fix SUGGESTIONS (does NOT modify files) using WCAG/ARIA references.
naporin0624/claude-web-audit-plugins
Command
Comprehensive DevSecOps security audit that launches multiple specialized agents in parallel. Covers secrets, SAST, SCA, container security, and IaC scanning based on OWASP DevSecOps Guideline.
naporin0624/claude-web-audit-plugins
Command
Run comprehensive SEO audit combining static analysis and Lighthouse.
naporin0624/claude-web-audit-plugins
Command
Run comprehensive web resource file audit (sitemap.xml, robots.txt, llms.txt, security.txt).
naporin0624/claude-web-audit-plugins
Command
Two-phase intelligent attack strategy. Quick scan (path discovery + CVE) for fast reconnaissance, followed by deep scan (XSS/SQLi/CSRF/IDOR) for comprehensive coverage. Maximum efficiency, maximum bounty.
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Proactively validates Claude Code's own generated HTML/JSX/TSX output for accessibility before presenting to users. Use this skill automatically when generating UI code to ensure WCAG 2.1 AA compliance.
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Looks up OWASP Top 10 attack methods, CWE references, and form-specific vulnerability patterns with a bounty hunter mindset. Returns attack vectors, payloads, and payout estimates. Use when user asks about "XSS", "SQL injection", "CSRF", "OWASP", "CWE", "IDOR", "injection", "bypass", "vulnerability", "exploit"…
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Scans containers and Dockerfiles for security issues. Wraps Hadolint for Dockerfile linting and Trivy for container image scanning. Use when user asks to "scan Dockerfile", "lint Dockerfile", "container security", "image scan", "Dockerセキュリティ", "コンテナスキャン".
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Searches the NIST NVD database for CVE vulnerabilities using API 2.0. Returns CVE details, CVSS scores, affected software, and references. Use when user asks about "CVE", "vulnerability database", "NIST", "NVD", "security advisory", "CVE-2024", "CVE-2023", "脆弱性", "セキュリティアドバイザリ", or wants to find known vulnerabilities…
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Looks up OWASP DevSecOps Guideline phases, security tools, and pipeline checks. Returns tool configurations, CWE mappings, and integration patterns for CI/CD security. Use when user asks about "DevSecOps", "SAST", "DAST", "SCA", "container security", "IaC security", "secret detection", "gitleaks", "semgrep", "trivy"…
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Static security analysis of HTML forms without sending any requests. Checks for CSRF tokens, insecure actions, missing validation, hidden field issues, and common security misconfigurations. Safe to run - no payloads sent. Use when user asks to "analyze form security", "check form for vulnerabilities", "static…
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Runs automated HTML linting using @axe-core/playwright (WCAG accessibility) and markuplint (HTML standards). Use when user asks to "lint HTML", "run automated checks", "validate HTML", "check accessibility", or mentions "axe-core", "markuplint", "automated audit".
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Scans Infrastructure as Code for security misconfigurations. Wraps tfsec for Terraform and Checkov for multi-cloud IaC. Use when user asks to "scan Terraform", "IaC security", "infrastructure scan", "tfsec", "checkov", "Terraformセキュリティ", "インフラスキャン".
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Runs Google Lighthouse audits using Playwright for SEO, Performance, Accessibility, and Best Practices scoring. Supports both URLs and local HTML files. Use when user mentions "Lighthouse", "page speed", "performance audit", "Core Web Vitals", "CWV", or needs comprehensive web performance analysis.
naporin0624/claude-web-audit-plugins
Skill Claude CodeCodex
Dynamic security testing of web forms using Playwright browser automation. Sends actual payloads to test for vulnerabilities. REQUIRES USER CONFIRMATION before execution. Use when user wants to "test payloads", "dynamic security test", "exploit testing", "penetration test forms".