Menu
Run a red team offensive security assessment on the app: reconnaissance, code analysis, exploit development, and remediation recommendations.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.
Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.
Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]
Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]
Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]
Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]
| name | redteam |
| description | Run a red team offensive security assessment on the app: reconnaissance, code analysis, exploit development, and remediation recommendations. |
Run the full offensive security assessment pipeline against ./app/ or a target URL.
/redteam # Assess ./app/ code + local endpoints
/redteam --target https://example.com # Assess a live target
/redteam --phase 3 # Resume from Phase 3 (PoC execution)
cd .claude/security/redteam && npm install
# External recon binaries are OPTIONAL. Every tool has a Node-native fallback.
# On Linux/macOS:
bash scripts/install_recon_deps.sh
# On Windows:
pwsh scripts/install_recon_deps.ps1
For an authenticated run that drives all 4 agents in sequence via the Anthropic Agent SDK:
cd .claude/security/redteam
node pipeline/claude_sdk.js <target-path> \
--agents all \
--endpoint http://localhost:3000 \
--domain localhost \
--identifier my_run
The orchestrator extracts JSON from ```json fences when agents emit
markdown-wrapped output (common pattern), so all four deliverables in
deliverables/ end up as valid JSON ready for the HTML generators.
Execute in phase order. Read .claude/security/redteam/CLAUDE.md for the full protocol.
| Phase | Agent(s) | Parallelism | Skill File |
|---|---|---|---|
| 1 | Recon + Code Analysis | Parallel | skills/01-recon-agent.md + skills/02-code-analysis-agent.md |
| 2 | Dependency + Infrastructure + SAST + Secrets | Parallel | skills/05-* through skills/08-* |
| 3 | PoC Execution | Sequential (needs Phase 1) | skills/03-poc-execution-agent.md |
| 4 | Remediation | Sequential (needs Phase 3) | skills/04-recommendation-agent.md |
deliverables/ as JSON10 JavaScript recon wrappers in .claude/security/redteam/tools/recon/, each implementing a 3-step dispatcher (external binary → Node-native fallback → structured error JSON):
dns_enum.js, whois_lookup.js, subdomain_discovery.js, port_scan.js, tls_scan.js, http_headers.js, tech_fingerprint.js, waf_detect.js, endpoint_discovery.js, ct_search.js
Additional standalone scanner wrappers in scripts/: nmap_scan.js (TCP-connect fallback), semgrep_scan.js, trufflehog_scan.js (with regex sweep fallback), osv_scan.js (with OSV.dev REST fallback), zap_scan.js (manual-run guide / --auto-docker). See .claude/references/security-redteam.md for the full matrix.
After each agent completes, generate its HTML report:
cd .claude/security/redteam
node scripts/recon_json_to_html.js deliverables/recon_deliverable.json
node scripts/code_analysis_json_to_html.js deliverables/code_analysis_deliverable.json
node scripts/poc_json_to_html.js deliverables/poc_testing.json
node scripts/remediation_json_to_html.js deliverables/remediation_report.json
After red team completes, findings should cross-reference with blue team:
.env files or production secrets[REDACTED-*] placeholders for credential values