/ 目录 / 演练场 / claude-cybersecurity
● 社区 AgriciDaniel ⚡ 即开即用

claude-cybersecurity

作者 AgriciDaniel · AgriciDaniel/claude-cybersecurity

Defensive code-review skill: 8 parallel agents for vulns, authz, secrets, supply chain, IaC, threat intel, AI-code patterns, and business-logic flaws — OWASP 2025 + CWE Top 25 + MITRE.

Zero-config defensive security review built for Claude Code. Deploys 8 specialist agents in parallel covering vulnerability detection, authorization, secret scanning, supply chain, IaC, threat intel (malware / C2 / backdoor patterns), AI-generated code patterns, and business logic flaws. Maps findings to OWASP 2025, CWE Top 25, MITRE ATT&CK, PCI-DSS. 11+ languages. Complements (not replaces) GitHub Advanced Security.

为什么要用

核心特性

实时演示

实际使用效果

claude-cybersecurity-skill.replay ▶ 就绪
0/0

安装

选择你的客户端

~/Library/Application Support/Claude/claude_desktop_config.json  · Windows: %APPDATA%\Claude\claude_desktop_config.json
{
  "mcpServers": {
    "claude-cybersecurity-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/AgriciDaniel/claude-cybersecurity",
        "~/.claude/skills/claude-cybersecurity"
      ],
      "_inferred": true
    }
  }
}

打开 Claude Desktop → Settings → Developer → Edit Config。保存后重启应用。

~/.cursor/mcp.json · .cursor/mcp.json
{
  "mcpServers": {
    "claude-cybersecurity-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/AgriciDaniel/claude-cybersecurity",
        "~/.claude/skills/claude-cybersecurity"
      ],
      "_inferred": true
    }
  }
}

Cursor 使用与 Claude Desktop 相同的 mcpServers 格式。项目级配置优先于全局。

VS Code → Cline → MCP Servers → Edit
{
  "mcpServers": {
    "claude-cybersecurity-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/AgriciDaniel/claude-cybersecurity",
        "~/.claude/skills/claude-cybersecurity"
      ],
      "_inferred": true
    }
  }
}

点击 Cline 侧栏中的 MCP Servers 图标,然后选 "Edit Configuration"。

~/.codeium/windsurf/mcp_config.json
{
  "mcpServers": {
    "claude-cybersecurity-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/AgriciDaniel/claude-cybersecurity",
        "~/.claude/skills/claude-cybersecurity"
      ],
      "_inferred": true
    }
  }
}

格式与 Claude Desktop 相同。重启 Windsurf 生效。

~/.continue/config.json
{
  "mcpServers": [
    {
      "name": "claude-cybersecurity-skill",
      "command": "git",
      "args": [
        "clone",
        "https://github.com/AgriciDaniel/claude-cybersecurity",
        "~/.claude/skills/claude-cybersecurity"
      ]
    }
  ]
}

Continue 使用服务器对象数组,而非映射。

~/.config/zed/settings.json
{
  "context_servers": {
    "claude-cybersecurity-skill": {
      "command": {
        "path": "git",
        "args": [
          "clone",
          "https://github.com/AgriciDaniel/claude-cybersecurity",
          "~/.claude/skills/claude-cybersecurity"
        ]
      }
    }
  }
}

加入 context_servers。Zed 保存后热重载。

claude mcp add claude-cybersecurity-skill -- git clone https://github.com/AgriciDaniel/claude-cybersecurity ~/.claude/skills/claude-cybersecurity

一行命令搞定。用 claude mcp list 验证,claude mcp remove 卸载。

使用场景

实战用法: claude-cybersecurity

Pre-release security review of a new service

👤 Engineering teams before shipping to production ⏱ ~60 min intermediate

何时使用: Before a release with a new or heavily changed service.

前置条件
  • Skill installed — git clone https://github.com/AgriciDaniel/claude-cybersecurity ~/.claude/skills/claude-cybersecurity
步骤
  1. Run the full 8-agent pass
    Use claude-cybersecurity on services/payment. Full pass — vulns, authz, secrets, supply chain, IaC, business logic.✓ 已复制
    → Report with findings per agent, severity, OWASP/CWE mapping
  2. Triage and route
    Group by severity. For each critical/high, draft a GitHub issue with reproduction steps.✓ 已复制
    → Issue drafts ready to paste

结果: A defensible pre-release sign-off with a paper trail.

注意事项
  • Treating business-logic flags as false positives automatically — Those are the ones static tools miss — read them twice
搭配使用: github · repo-forensics-skill

Review AI-generated code for the mistakes LLMs make

👤 Teams accepting lots of PR code from Copilot/Claude/Cursor ⏱ ~45 min intermediate

何时使用: Auditing merged or pending PRs that were AI-assisted.

步骤
  1. Focus on the AI-code agent
    Use claude-cybersecurity — ai-code patterns only. Flag: hallucinated middleware, plausible-but-wrong crypto, trust-all defaults.✓ 已复制
    → Pattern-specific flags
  2. Cross-check authz flags
    Now run the authorization agent — AI tends to miss role checks on non-happy paths.✓ 已复制
    → Authz matrix showing gaps

结果: Catch the class of mistakes LLMs make before they ship.

搭配使用: github

Sweep infrastructure-as-code for dangerous defaults

👤 Platform teams ⏱ ~30 min intermediate

何时使用: Before merging Terraform / K8s / CloudFormation changes.

步骤
  1. Run IaC agent
    Use claude-cybersecurity IaC agent on terraform/ — flag public S3, open security groups, privileged pods.✓ 已复制
    → Misconfigs with severity + fix diffs

结果: Clean IaC before it hits the cluster.

Scan for malware / C2 / backdoor patterns in dependencies

👤 Security engineers auditing third-party code ⏱ ~30 min intermediate

何时使用: New dependency coming in, or suspicious dep update.

步骤
  1. Run threat-intel agent
    Run claude-cybersecurity threat-intel on node_modules — known malicious patterns.✓ 已复制
    → Pattern matches (or clean)

结果: Early warning before a malicious package slips in.

注意事项
  • False positives on obfuscated legitimate libs (e.g. minified SDKs) — Cross-check with published source; don't auto-remove
搭配使用: repo-forensics-skill

组合

与其他 MCP 搭配,撬动十倍杠杆

claude-cybersecurity-skill + repo-forensics-skill

Layer supply-chain + install-time audits with app-level code review

Run repo-forensics on the dep tree, then claude-cybersecurity on our app code.✓ 已复制
claude-cybersecurity-skill + github

Auto-file issues for each high-severity finding

After the review, open a GitHub issue per high finding with CWE + remediation.✓ 已复制

工具

此 MCP 暴露的能力

工具输入参数何时调用成本
agent_vulns code path Standard review 0
agent_authz code path Multi-role apps 0
agent_secrets code path Always 0
agent_supply_chain manifest files Dep updates 0
agent_iac iac dir Infra PRs 0
agent_threat_intel code/deps path Third-party audits 0
agent_ai_code code path AI-assisted PRs 0
agent_business_logic code path, domain hints High-trust workflows (payments, auth) 0

成本与限制

运行它的成本

API 配额
None
每次调用 Token 数
High — 8 agents in parallel
费用
Free
提示
Scope to the diff of a PR rather than whole repo when you can

安全

权限、密钥、影响范围

最小权限: Read on the code under review
凭据存储: None
数据出站: None beyond LLM call — findings stay local
切勿授予: Write access to the audited repo during review

故障排查

常见错误与修复

Too many findings to process

Filter by severity=high,critical first; revisit rest iteratively

Agent mislabels framework conventions as vulns

Provide framework context: 'this is Rails, strong_params is in use'

替代方案

claude-cybersecurity 对比其他方案

替代方案何时用它替代权衡
repo-forensicsYou need install-time / supply-chain vetting, not app code reviewDifferent threat model
GitHub Advanced Security (CodeQL)You want SAST integrated into the PR workflowMisses business logic and AI patterns

更多

资源

📖 阅读 GitHub 上的官方 README

🐙 查看未解决的 issue

🔍 浏览全部 400+ MCP 服务器和 Skills