secbots

Claude Code skill packs

Security automation
that ships as a folder.

Each pack is a set of Claude Code skills for one kind of security work. Unzip it, fill in one config file, run a dry run, and approve what it wants to change. You're running in under 30 minutes.

See the packsHow it works
~/appsec-skills-kit
# fill in one file
$ $EDITOR skills/appsec-setup/references/config.md
# dry run: reads tickets and code, writes nothing
> /sla-chaser dry run, next 7 days
  11 in scope · 9 reminders · 2 skipped · nothing written
> /sla-chaser remind, next 7 days
Post 9 comments?  Approve · Dry run only
01

Unzip

Plain skill files you can read and edit. Nothing runs on our servers.

02

Configure once

One config file for your tracker, SLAs, repos and owners.

03

Dry run

Every skill shows what it would do before it does anything.

04

Approve

Nothing writes to a ticket or repo until you say yes.

Grounded in your code, not the report

Point the kit at a local checkout of your repos once. After that, every triage traces the real code path before it gives a verdict. You review evidence instead of redoing the investigation.

  • Traces, doesn't guessFollows the path from the entry point to the flagged line and says whether attacker input can reach it.
  • Evidence you can clickEvery verdict cites file:line, pinned to a commit SHA, so engineers land on the exact line.
  • Claims are labeledEach claim is marked verified, evidenced, asserted or contradicted. Before anything is posted, fact-check rechecks it against the tracker, docs and code.
config.md + ~/your-code-repo
# once: tell the kit where your code lives
  PRIMARY_REPO   acme/platform
  OTHER_REPOS    acme/mobile, acme/infra
$ git clone --depth 1 <repo> your-code-repo
> is the SSRF in this bounty report reachable?
  entry   POST /api/import       routes/import.ts:14
    →     fetchFeed(url)         lib/feed.ts:31
    →     no allowlist before fetch
  verdict: reachable · evidence pinned to 3f2c9e1
Illustrative output from a fictional repo.

First packs

For application security teams

AppSec Skills Kit

Works the daily AppSec queue and checks your own code before every verdict: scanner findings, bug bounty reports, CVE questions, tickets and SLAs.

Coming soon
For engineers who build and ship

Engineering Security Kit

Threat models, secure patterns, scan triage, cloud reviews and incident help, built to stay quiet when things are fine.

Coming soon
In the build queue

More packs

More packs are on the way. Each one is a working starting point for one kind of security work.

Later