Security-research toolkit for Claude Code: source-level cryptographic auditing, Ghidra-driven binary verification of constant-time and zeroization guarantees, and zero-trust codebase security auditing. Every skill gates findings on traced evidence before reporting.
Claude Code instructions for Quant-Off/skills, covering claude.md, repository context, structural rules (never violate), marketplace facts and when you write or change a skill.
Verifies in compiled machine code that secret zeroization survived dead-store elimination and that constant-time logic did not regain secret-dependent branches. Ships a Ghidra headless inventory script. Use when auditing a binary, shared object, or firmware image against a source-level guarantee.
Verifies in compiled machine code that security properties survived the compiler: that secret zeroization was not removed by dead-store elimination and that constant-time logic did not regain secret-dependent branches. Use when auditing a binary, shared object, static library, or firmware image whose source claims…
Audits a codebase or file for exploitable vulnerabilities across injection, authorization, secrets, memory safety, deserialization, SSRF, and dependency risk, gating every candidate through six reachability and impact reviews before reporting. Not for deep crypto review or binary verification.
Audits a codebase, module, or single file for exploitable vulnerabilities across injection, authentication and authorization, secrets management, memory safety, deserialization, SSRF, and dependency risk, gating every candidate through reachability and impact review before reporting. Use when asked to security-audit…
Audits cryptographic source for timing side channels, missing secret zeroization, non-constant-time comparison, and weak randomness. Use when reviewing crypto primitives, key handling, or any code touching secret material. Not for binary verification or general vulnerability hunting.
Audits cryptographic source code for timing side channels, missing secret zeroization, non-constant-time comparison, and weak randomness. Use when reviewing crypto primitives, key/nonce/PSK handling, TLS or handshake code, signature or KEM implementations, or any function that touches secret key material, including…