A whitebox penetration testing plugin for Claude Code that covers security skills for AI and ML attacks, business logic flaws, cache poisoning, cloud-native risks and compliance mapping, with threat modeling and Semgrep integration.
@allsmogThis skill should be used when the user asks about "AI security", "ML pipeline attacks", "prompt injection", "model…
@allsmogThis skill should be used when the user asks about "business logic", "workflow vulnerability", "trust boundary", "state machine",…
@allsmogThis skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx…
@allsmogThis skill should be used when the user asks about "cloud security", "AWS security", "GCP security", "Azure security",…
@allsmogThis skill should be used when the user asks about "compliance mapping", "PCI-DSS", "HIPAA", "SOC 2", "NIST CSF", "regulatory…
@allsmogThis skill should be used when the user asks about "Code Property Graph", "CPG analysis", "Joern queries", "CPGQL", "data flow…
@allsmogThis skill should be used when analyzing multi-service architectures, frontend-backend interactions, microservices, or when…
@allsmogThis skill should be used when the user asks about "cryptographic failures", "weak encryption", "hardcoded secrets", "insecure…
@allsmogThis skill should be used when the user asks about "dangerous functions", "security sinks", "what functions are dangerous in…
@allsmogThis skill should be used when the user asks to "trace data flow", "follow user input", "source to sink analysis", "track…
@allsmogThis skill should be used when the user asks about "XXE", "XML External Entity", "error handling", "exception disclosure", "stack…
@allsmogThis skill should be used when the user asks to "write an exploit", "create PoC", "develop proof of concept", "exploit script",…
@allsmogUse this agent when the user asks to "understand the application", "map the codebase", "analyze the architecture", "identify…
@allsmogAutonomous attack vector exploration agent that hypothesizes novel attack vectors, tests them against the codebase, and iterates.…
@allsmogUse this agent when the user asks to "review code for security", "find vulnerabilities", "security audit", "analyze for security…
@allsmogUse this agent to verify security findings and eliminate false positives. Analyzes code context, data flow paths, and…
@allsmogUse this agent when the user wants to "test a vulnerability", "confirm exploitation", "debug the application", "verify the…
@allsmogUse this agent when the user is auditing a decompiled mobile application (Android jadx_out/apktool_out trees, iOS .ipa or Swift…
@allsmogUse this agent when the user asks to "fix the vulnerability", "patch the code", "remediate the issue", "secure coding…
@allsmogUse this agent when the user wants to "write an exploit", "create a PoC", "develop proof of concept", "automate the attack", or…
@allsmogUse this agent when the user asks to "create a threat model", "analyze threats", "STRIDE analysis", "what are the threats",…
@allsmog[experimental] Auto-remediate verified findings by generating patches and optionally creating a PR
@allsmog[experimental] Create a custom Semgrep detection rule from a confirmed vulnerability pattern
@allsmog[stable] Compare security posture between two git refs to find new/fixed vulnerabilities and track regression
@allsmog[stable] End-to-end security audit with hotspot-aware framework pivots, shared findings.json schema, and CI-friendly workflow…
@allsmog[beta] Audit a decompiled Android target — scans jadx_out/sources + apktool_out together and merges findings
@allsmog[experimental] Security mutation testing -- weaken security controls and check if the scanner detects the resulting vulnerability
@allsmog[experimental] Compile human-reviewed scan history into local organization memory
@allsmog[beta] Pattern propagation - find all instances of a vulnerability pattern throughout the codebase
@allsmog[stable] Generate report output from `.claude/findings.json` in markdown, json, SARIF, interactive HTML, PR comment, or evidence…
@allsmog[beta] Run quick, deep, or audit scan profiles and emit a shared findings artifact
@allsmog[stable] Prepare focused analysis scope for large codebases, list workspaces in monorepos
@allsmog[beta] Search for dangerous functions (sinks) and auto-discover output patterns
@allsmogIs this you? Claim your profilePut a plugin at the top of Plugins, from $9
