Audit code, find vulnerabilities and stop secrets before the commit.
Application security rarely fails for lack of knowledge, it fails for lack of time. An API key left in a configuration file, an endpoint that trusts the identifier sent by the client, a transitive dependency with a CVE that has been open for months. None of this shows up in the tests and none of it breaks the build. It usually comes to light when someone outside notices before the team does.
The components on this page put that check inside your normal workflow. There are agents that review a diff looking for authentication flaws, injection and data exposure, commands that scan the whole repository for secrets or vulnerable dependencies, and an automation that runs static analysis tools every time a file is saved. The result is a list of concrete issues, with file, line and a suggested fix.
Start with what hurts most in your project. If you have never done an audit, a generalist agent gives you the initial picture. If you already have code review in place, add secret detection and dependency auditing first, since those are the cheapest flaws to fix. The threat modeling and compliance skills are for planned work: use them when you design a sensitive feature or prepare for an external audit.
21 hand-picked components, from 4 different angles.
The first picture of a project's security posture and the recurring review of each change. This is where you start when there is no defined process yet.
A starting point when there is no security process yet: it goes through controls, configurations and code, and returns prioritized gaps with evidence instead of a generic list.
Use this agent when conducting comprehensive security audits, compliance assessments, or risk evaluations across systems, infrastructure, and processe
A review focused on a diff or a module, with the plan adjusted to the type of code: the OWASP Top 10 for web APIs, the OWASP LLM Top 10 when there is an integration with language models.
Security-focused code review specialist with OWASP Top 10, Zero Trust, LLM security, and enterprise security standards
The hooks declared in its frontmatter block Write, Edit and Bash for the whole audit, which makes it suitable for pre-merge or compliance reviews where nothing may be changed.
Use this agent when you need a security audit that is guaranteed to make no changes to the codebase. This agent has hooks in its frontmatter that bloc
A checklist that kicks in while you write the feature, not afterwards: authentication, user input, new endpoints, payments and anything that touches secrets.
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive featur
For anyone who needs to map the attack surface and decide what to fix first, with up-to-date OWASP principles and a validation script that runs against the project.
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
Each layer has its own flaws. These components know the attack patterns specific to each one, instead of applying the same checklist to everything.
Specialized in REST APIs: poorly validated JWT tokens, privilege escalation in access control and injection into SQL, NoSQL or system commands.
API security audit specialist. Use PROACTIVELY for REST API security audits, authentication vulnerabilities, authorization flaws, injection attacks, a
Useful at the design stage, before there is code to audit: authentication, authorization, input validation and rate limiting patterns for REST, GraphQL and WebSocket.
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulne
GraphQL raises problems that do not exist in REST, such as unbounded nested queries. It handles query validation and authorization at the resolver level.
GraphQL API security and authorization specialist. Use PROACTIVELY for GraphQL security audits, authorization implementation, query validation, and pr
When the project is built on Supabase, the real risk lies in the Row Level Security policies and the keys exposed to the client. That is exactly what this command reviews.
Conduct comprehensive Supabase security audit with RLS analysis and vulnerability assessment
For anyone who publishes MCP servers: it reviews the OAuth implementation, the role-based permission design and the places where the server exposes more than it should.
MCP server security specialist. Use PROACTIVELY for security reviews, OAuth implementation, RBAC design, compliance frameworks, and vulnerability asse
Many flaws are not in the logic you wrote, they are in what you brought in from outside or what was left forgotten in the repository. They are also the quickest to fix.
An automation that runs after every Edit or Write. If you have semgrep, bandit or gitleaks installed, the warning appears the moment the file is saved.
Scan code for security vulnerabilities and secrets after modifications. Uses multiple security tools to detect potential issues.
A one-off scan of the repository for API keys, passwords and certificates, including old commits whose message suggests they touched credentials.
Scan codebase for exposed secrets, credentials, and sensitive information
Calls the ecosystem's native auditor (npm, pip, cargo) and checks known vulnerabilities, outdated packages and licensing issues in a single pass.
Audit dependencies for security vulnerabilities, license compliance, and update recommendations
Goes beyond the CVE list: it detects typosquatting, dependency confusion and protestware, and generates an SBOM in SPDX or CycloneDX for anyone who has to deliver that document.
An AI security specialist focused on software supply chain threats: dependency vulnerabilities, malicious packages, SBOM generation, license complianc
Starts from indicators of real attacks on npm, PyPI, crates.io and GitHub Actions, which helps when there is a concrete suspicion about a compromised package.
Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised pack
Finding secrets is half the job, storing them is the other half: it covers Vault, AWS Secrets Manager, automatic rotation and least privilege in CI/CD pipelines.
Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
Planned work instead of reactive work: understanding what can go wrong before you write the code and being able to prove afterwards that the controls exist.
Produces a threat model grounded in the real repository, with trust boundaries, assets, attacker capabilities and abuse paths, instead of a generic document.
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concis
The methodology behind the exercise: STRIDE, PASTA and attack trees, useful when the review is architectural and there is no code to analyze yet.
Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirem
Once you know what is missing, it applies concrete controls: HTTP headers, authentication configuration, encryption and infrastructure-level settings.
Harden application security configuration with comprehensive security controls
A good fit for products with users in the European Union, with data protection impact assessments and GDPR compliance checks.
Senior GDPR/DSGVO expert and internal/external auditor for data protection compliance. Provides EU GDPR and German DSGVO expertise, privacy impact ass
When a client asks for evidence of SOC 2, PCI DSS or ISO, it helps you prepare for the audit: evidence gathering, security policies and risk assessment.
Security compliance and regulatory framework specialist. Use PROACTIVELY for compliance assessments, regulatory requirements, audit preparation, and g
The agents on this page are Markdown files that live in .claude/agents/ inside the repository, or in ~/.claude/agents/ if you want them in every project. Skills go in .claude/skills/, each in its own folder, and Claude Code loads them when the request matches their description. Commands go in .claude/commands/ and become available as shortcuts named after the file. The static analysis automation is different: it is a configuration block that you add to settings.json, in the PostToolUse hooks section. Keep everything under version control, so the whole team has the same controls and any change to the rules is recorded.
These components work best in layers, each with its own cadence. The static analysis automation runs on every file save and catches the obvious mistake while it is still fresh. The secret scanning and dependency audit commands run once a week or before each release, because they analyze the whole repository and take longer. The review agents come in before merging a change that touches authentication, payments, uploads or database queries. Threat modeling sits outside this cycle: you do it at the start of a sensitive feature and revisit it when the architecture changes.
It is worth being clear about the limits. Several of these components depend on external tools installed on the machine, such as semgrep, bandit, gitleaks or the package manager's auditor. Without them, the analysis comes down to what the model can read in the code. A model-assisted review also produces false positives and can miss a business logic flaw that only makes sense to someone who knows the product. None of this replaces an authorized penetration test or an independent audit when there is a contractual or regulatory obligation. Treat the results as a list of leads to confirm, not as a certificate.
It depends on the component. The agents and skills work by reading the code and need no extra installation. The static analysis automation, on the other hand, calls semgrep, bandit and gitleaks, and the dependency audit calls npm audit, pip or cargo audit. If those tools are not on the machine, the commands carry on without an error, but the coverage is much smaller.
Review diffs, catch bugs before the merge and reduce technical debt.
MCP connectors, agents and skills for schema, SQL queries, migrations and performance.
Components to package, ship and keep software running in production.
Prompts and resources curated from international sources, normalized and categorized: over 11 thousand. A Doutor AI bot checks the sources every day and brings in what is new.
Need a tailor-made solution?
Not sure where to start with AI in your business? Get a free assessment and a tailored plan - no commitment.
Doutor AI gives you 1,859 ready-to-copy AI prompts, by industry and in plain English - plus a complete technical library for those who want to go further.
