# vuln-scout

AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 22 skills, 7 autonomous agents. STRIDE threat modeling, OWASP 2025 coverage, polyglot monorepo support.

- Tier: Indexed (plain plugin)
- Category: Security
- Page: https://www.flowy.sh/listings/allsmog-vuln-scout
- Source: https://github.com/allsmog/vuln-scout
- Price: free and open source

## Summary
vuln-scout is a Claude Code plugin with 35 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes ai-ml-attacks, business-logic, cache-poisoning. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

## Install (Claude Code)
```
npx -y skills add allsmog/vuln-scout
```

## Skills
- ai-ml-attacks
- business-logic
- cache-poisoning
- cloud-native
- compliance-mapping
- cpg-analysis
- cross-component
- cryptographic-failures
- dangerous-functions
- data-flow-tracing
- exception-handling
- exploit-techniques
- framework-patterns
- logging-failures
- mixed-language-monorepos
- mobile-android
- mobile-ios
- mobile-payments
- nextjs-react
- owasp-2025
- owasp-api-top10
- postmessage-xss
- sandbox-escapes
- secret-scanning
- security-misconfiguration
- sensitive-data-leakage
- package-evidence
- review-pr
- scope-repo
- start-audit
- verify-finding
- threat-modeling
- vuln-patterns
- vulnerability-chains
- workspace-discovery

## FAQ

### What is vuln-scout?
AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 22 skills, 7 autonomous agents. STRIDE threat modeling, OWASP 2025 coverage, polyglot monorepo support.

### How do I install vuln-scout?
Run these in Claude Code: npx -y skills add allsmog/vuln-scout. Then prompt normally.

### Does vuln-scout auto-invoke its skills?
Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

### Is vuln-scout free?
Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.