cxsec-security

name	cxsec-security
description	Application security review toolkit — scan a repository, PR, commit, branch diff, or working-tree patch for vulnerabilities; run a deep multi-pass scan; triage findings you already have from SARIF/CVEs/advisories/scanner tickets; fix and verify a finding; write a disclosure report; author or review a repository SECURITY.md; file findings as Linear/Jira/GitHub issues or a GitHub security advisory; or propose structural security hardening. Use for security audits, vulnerability hunting, appsec review, threat modeling, attack-path and severity analysis, exploitability triage, security regression review of a change set, and CWE/CVSS-grounded reporting with SARIF output. Triggered by requests like 'audit this repo for vulnerabilities', 'security review this PR', 'run a deep scan', 'is this CVE exploitable here', 'triage this SARIF', 'fix and verify this finding', 'write this up for disclosure', 'draft a SECURITY.md', 'file these findings in Linear'.
license	Apache-2.0
compatibility	Requires python3 and the vendored codex-security runtime at $CXSEC_HOME (default ~/.claude/codex-security), with scripts/ and schemas/ as siblings. Run scripts/install.sh to install or verify it. Modes 4 and 8 also need gh or a connected GitHub/Linear/Atlassian MCP server. Scanning makes no network calls.
allowed-tools	Bash(bash ~/.claude/skills/cxsec-security/scripts/install.sh:*) Bash(~/.claude/skills/cxsec-security/scripts/install.sh:*) Read Write Edit Glob Grep Task Agent AskUserQuestion TodoWrite WebFetch mcp__linear__* mcp__atlassian__* Bash(python3:*) Bash(python:*) Bash(git:*) Bash(gh:*) Bash(rg:*) Bash(grep:*) Bash(find:*) Bash(ls:*) Bash(cat:*) Bash(head:*) Bash(tail:*) Bash(wc:*) Bash(jq:*) Bash(sed:*) Bash(awk:*) Bash(sort:*) Bash(uniq:*) Bash(diff:*) Bash(file:*) Bash(mkdir:*) Bash(cp:*) Bash(mv:*) Bash(sha256sum:*) Bash(date:*) Bash(npm:*) Bash(pnpm:*) Bash(yarn:*) Bash(node:*) Bash(pytest:*) Bash(cargo:*) Bash(go:*) Bash(make:*)

Security Review Toolkit

Nine workflows behind one entry point. Pick the mode first, read only that mode's file, then follow it. Do not read every reference — each mode names the further files it needs.

Mode selection

Match the request against this table. The distinguishing question is in the third column; use it when two modes look close.

#	Mode	Choose when	Read
1	Repository scan	Audit a whole repo, or a scoped path/package/folder/submodule. No diff involved. The default scan.	references/mode-repo-scan.md
2	Diff scan	Review a change set: pull request, commit, branch diff, or working-tree patch. Git-backed.	references/mode-diff-scan.md
3	Deep scan	Explicitly asked for deep, exhaustive, multi-pass, or variance-reducing. Repo-wide only, never a diff.	references/mode-deep-scan.md
4	Triage	The user already has findings — SARIF, CVE/GHSA, advisories, scanner tickets, bug-bounty reports, Jira/Linear issues — and wants repo-impact verdicts. No discovery.	references/mode-triage.md
5	Fix	Fix and verify one already-identified finding.	references/mode-fix.md
6	Write-up	Turn notes/PoCs/findings into a distributable disclosure report.	references/mode-writeup.md
7	Policy	Author, review, or update a repository SECURITY.md.	references/mode-policy.md
8	Track	File findings as Linear/Jira/GitHub issues, or a draft GitHub security advisory.	references/mode-track.md
9	Harden	Structural or architectural improvements beyond per-finding patches; before/after views, tradeoffs, migration plan.