vantage
AI SAST framework for web & mobile apps, shipped as a Claude Code plugin. Agents read your source code and produce a validated, evidence-backed vulnerability report, no running the app, no network requests.
1 skill4
@tinoimammpPlugins
1@tinoimammpSkill
1Agents
29api-agent
AgentSAST specialist for API-layer vulnerabilities: JWT attacks, GraphQL introspection/batching abuse, mass assignment, BFLA. Invoke…
@tinoimammpauth-agent
AgentSAST specialist for authentication vulnerabilities (login/session/MFA/SSO bypass, weak password reset, JWT/session flaws). Invoke…
@tinoimammpauthorization-agent
AgentSAST specialist for authorization vulnerabilities: IDOR, BOLA, BFLA, privilege escalation, mass assignment. Invoke during Phase…
@tinoimammpbinary-protection-agen…
AgentSAST specialist for OWASP Mobile M7:2024 Insufficient Binary Protections. Invoke during mobile Phase 03 Testing after…
@tinoimammpbusiness-logic-agent
AgentSAST specialist for business-logic vulnerabilities (race conditions, workflow bypass, price/grade/quantity tampering). Invoke…
@tinoimammpcredential-usage-agent
AgentSAST specialist for OWASP Mobile M1:2024 Improper Credential Usage. Invoke during mobile Phase 03 Testing after…
@tinoimammpdependency-agent
AgentSAST specialist for vulnerable dependencies (SCA against known CVEs), scoped to Medium-Critical impact only. Invoke during Phase…
@tinoimammpfix-agent
AgentApplies code-level remediation for a validated SAST finding (web or mobile). Invoked explicitly by /vantage:fix-issue…
@tinoimammpinjection-agent
AgentSAST specialist for server-side injection (command injection, SSTI, SSRF, path traversal, XXE, LDAP injection), scoped to…
@tinoimammpmapper-agent
AgentDomain-aware attack-surface prioritization specialist. Invoke in Phase 02, after artifacts/recon/endpoints.json and…
@tinoimammpmisconfiguration-agent
AgentSAST specialist for Security Misconfiguration (OWASP A02:2025): missing security headers, permissive CORS, verbose errors/stack…
@tinoimammpmobile-auth-agent
AgentSAST specialist for OWASP Mobile M3:2024 Insecure Authentication/Authorization. Invoke during mobile Phase 03 Testing after…
@tinoimammpCommands
6fix
CommandApply code-level fixes for ALL validated findings, one at a time — modifies the target repository's source code
@tinoimammpfix-diff
CommandApply a code-level fix for a finding from /vantage:scan-diff's commit/PR/MR scan — modifies the target repository's source code
@tinoimammpfix-issue
CommandApply a code-level fix for one validated finding by id (e.g. F-001) — modifies the target repository's source code
@tinoimammpscan-diff
CommandScan only the changed files in a single commit or PR/MR for newly introduced vulnerabilities (fast incremental check, not a full…
@tinoimammpscan-mobile
CommandRun the full mobile SAST pipeline (phases 01-06) against this repository — Android, iOS, React Native, or Flutter
@tinoimammpscan-web
CommandRun the full web SAST pipeline (phases 01-06) against this repository
@tinoimammpIs this you? Claim your profilePut a plugin at the top of Plugins, from $9