Agent skill · security · code-yeongyu
security-research
security-research — an agent skill for coding agents.
Why this skill is useful
Adds a structured team-based vulnerability audit process with specific roles and responsibilities, enhancing the AI's capability to conduct thorough security assessments.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 67,387 stars on the source repository.
What this skill does
Security Research - Team Mode Vulnerability Audit Use this skill to run a parallel security audit that separates real exploitability from generic concern. The team has 3 vulnerability hunters and 2 PoC engineers. Hard Preconditions Before starting, verify: 1. team tools are available. If not, stop and tell the user: security-research requires team-mode. Set teammode.enabled: true in your .omo/omo.jsonc config, restart opencode, then retry. 2. You are in the main session, not a background subagent. 3. You have a concrete target: repository, diff range, PR, release candidate, path list, or threat surface. If the user provided no target, audit the current repository and current branch diff against its upstream or merge base. If there is no diff, audit the security-sensitive surfaces in the working tree. Severity Standard Use these references as the scoring frame: CWE for root-cause weakness classification: https://cwe.mitre.org/ OWASP WSTG for test methodology: https://devguide.owasp.org/en/06-verification/01-guides/01-wstg/ OWASP ASVS for control verification: https://owasp.org/www-project-application-security-verification-standard/ CVSS v4.0 for exploitability and impact scoring: https://www.first.org/cvss/v4.0/specification-document Rules: No severity without an attack path. No critical or high finding without concrete exploit preconditions and impact. Keep CWE category separate from severity. Prefer a small, reproducible PoC over theoretical language. Never run destructive exploits against real services or third-party systems. Use local fixtures, toy payloads, dry runs, or static proof when real execution would be unsafe. Team Roster Create one Team Mode run with these 5 members: Member Kind Category Role -------- ------ ---------- ------ surface-hunter category deep Map entry points, trust boundaries, and reachable attack surfaces. auth-data-hunter category ultrabrain Hunt auth, authorization, data isolation, injection, and secret handling flaws. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills code-yeongyu/security-research--ff6566