137 tagged appsec, measured the same way as everything else here.
Browse within: owasp 46ai-security 31agentic-appsec 23agentic-workflows 23container-scanning 23endor-labs 23malware-response 23owasp-juice-shop 23owasp-llm 23owasp-llm-top-10 23CVE 21fuzzing 21red-team 18github-copilot 14
Agent Claude Code
Duplication and placement reviewer for OWASP cheat sheet changes. Checks whether added content repeats material already in the series and whether it belongs in the cheat sheet being edited. Invoked by /review-cheatsheet-pr.
Agent Claude Code
Link and source-quality auditor for OWASP cheat sheet changes. Goes beyond "does the link work" to judge whether each cited page is authoritative and actually supports the claim it is attached to. Invoked by /review-cheatsheet-pr.
Agent Claude Code
Developer-practicality reviewer for OWASP cheat sheet changes. Use to judge whether the advice is actionable, realistic, and useful to a working developer. Invoked by /review-cheatsheet-pr.
Agent
Distills a past security report into a reusable agentgg agent that catches the same anti-pattern if it recurs in this codebase.
Agent
Picks folders a SAST run doesn't need to scan (test directories, fixtures, docs, generated code, vendored deps) so the scan skips them.
Agent
Fast, high-level survey that orients the security agents — what the project is, its stack, auth model, integrations, and notable areas.
Agent Claude Code
Round 2 verification — reviews brutalist decisions for false negatives and severity over-corrections.
Agent Claude Code
Round 1 verification — re-runs PoCs with maximum skepticism, checks severity inflation, filters non-bugs.
Agent Claude Code
Collects bounded pre-grade evidence packs for final reportable findings (HTTP via bobhttpscan; SC via family runners).
Robotti-io/copilot-security-instructions
Agent
Audits and improves this repository’s security-focused Copilot library content (root-level agents/, prompts/, skills/, README.md, copilot-instructions.md) and proposes concrete patches.
Robotti-io/copilot-security-instructions
Agent
Designs secure architectures and guardrails. Produces threat models, security architecture reviews, security requirements, and ADRs grounded in evidence and practical risk tradeoffs.
Robotti-io/copilot-security-instructions
Agent
Entry-point AppSec router that standardizes intake, delegates to specialist agents, and synthesizes evidence-first outputs.
Agent
Use this agent to verify security findings and eliminate false positives. Analyzes code context, data flow paths, and exploitability with structured evidence to determine if a finding is a true positive or false positive.
Agent
Use this agent when the user wants to "write an exploit", "create a PoC", "develop proof of concept", "automate the attack", or needs help creating exploit scripts during Phase 3 of whitebox security review.
Agent
Use this agent when the user asks to "create a threat model", "analyze threats", "STRIDE analysis", "what are the threats", "threat modeling", "identify attack vectors", "map attack surface", or needs systematic threat identification with data flow diagrams.
Agent
Orchestrate batch CVE exploitability analysis across many known advisories. Activate to triage a list of CVEs/GHSAs for reachability in a codebase — sourced from an SBOM, a Fortify on Demand release, a Fortify SSC application version, a local file (CSV/JSON/text), or an explicitly provided list. Never discovers CVEs…
Agent
Orchestrate end-to-end onboarding of new applications into Fortify (FoD or SSC). Activate to create one or more new Fortify applications, set up a project or repo for Fortify scanning, or onboard an entire GitHub/GitLab/Azure DevOps organization. Handles app creation and optional CI/CD pipeline setup (PR included).
Agent
INTERNAL — Stage 4 of the create-threat-model skill. Rewrites the prose of an assembled threat model for clarity and consistency, and changes nothing else. Reads the bounded projection at .dispatch-context/editorial/blocks.json and writes one plan to .dispatch-context/editorial/plan.json; applyeditorialplan.py…
Agent
INTERNAL renderer for Stage 2 of create-threat-model. Invoke only from the skill after Stage 1 has produced validated intermediate artifacts.
Agent
INTERNAL — controller-dispatched cross-component threat triage; validates rating consistency and prioritization, writes .triage-flags.json, and annotates .threats-merged.json.
Agent Claude Code
Application Security Engineer. Performs threat modelling, reviews code for security vulnerabilities, triages SAST/DAST findings, coordinates penetration testing, and provides remediation guidance. This is the primary security SME throughout the SDLC. Use this agent when: A new architecture or significant feature…
Agent Claude Code
Secure Development Lead. Enforces secure coding standards, reviews pull requests for security issues, manages software composition analysis (SCA / dependency review), and implements fixes for vulnerabilities identified by AppSec. The bridge between security findings and developer-ready solutions. Use this agent when…
Agent Claude Code
Governance, Risk and Compliance Analyst. Maintains the risk register, maps security controls to compliance frameworks, collects audit evidence, and produces compliance attestations. Participates at the Plan, Design, Test and Release phases. Use this agent when: A new project requires a compliance framework mapping A…
Agent
You have a local arsenal of 784 cybersecurity skills (agentskills.io standard) installed at /.config/opencode/cybersec-arsenal/. When a security task appears (audit, threat model, vulnerability research, secrets, IaC, cloud, API, incident response, red or blue team, AI/LLM security, compliance), do not improvise. Find…