hack.proof

A skill repo that turns any coding agent into a security auditor.

Point Claude Code, Cursor, Codex, Copilot, Cline, Windsurf, or a plain agentic loop at this repo and it can run a real, end-to-end security pass on whatever you're building — recon, secrets, dependencies, source code, web/API surface, infra, containers, and a ranked report at the end. No dashboard, no SaaS signup, no seat license. Just markdown playbooks that call real, battle-tested open-source tools, plus scripts that run them for you.

Built for people shipping fast with AI ("vibe coders") who want the same depth of testing a pentest firm would give them, on every build, for free, before it ships.

How it works

Each folder in skills/ is a self-contained playbook: a SKILL.md describing when to use it, what tools it drives, the exact commands to run, how to interpret output, and what a finding looks like. They're written in plain English with copy-pasteable commands — any agent that can read a file and run a shell command can execute them. No proprietary format, no lock-in.

skills/full-security-audit/SKILL.md is the master playbook — it chains every other skill into one pass and produces a single ranked report. That's the one to point an agent at when you want "just audit this thing."

Quick start

The universal way — works with any agent. Drop the repo into your project and point your agent at the master playbook:

git clone https://github.com/ca-who-codes/hack.proof.git .hack.proof

Then prompt whatever agent you use:

Follow .hack.proof/skills/full-security-audit/SKILL.md against this repo and report findings.

That's it. The skill files are plain markdown, so any agent that can read a file and run a shell command can execute them — no plugin, no special mode.

Per-agent conveniences (optional — the universal way above already works everywhere):

Agent	Setup so it auto-discovers the skills
Claude Code	mkdir -p .claude/skills && cp -r .hack.proof/skills/* .claude/skills/ — then ask "run a full security audit."
Cursor / Windsurf	Add .hack.proof/AGENTS.md to your rules, or reference a SKILL.md in-chat.
Codex / Copilot / Cline / Amp / aider	Reference the SKILL.md path in your prompt as shown above.

Any agent that reads AGENTS.md will pick up the operating rules automatically once the folder is in your project.

No agent, just you and a terminal:

git clone https://github.com/ca-who-codes/hack.proof.git && cd hack.proof
./scripts/bootstrap.sh          # installs the underlying OSS tools
./scripts/full-audit.sh /path/to/your/project   # or a URL for a live target

Raw tool output lands in findings/<timestamp>/; point an agent at findings-report to synthesize it into a ranked report.md. See examples/report.md for what that looks like.

What's in the box

Skill	Answers
full-security-audit	"Is this build safe to ship?" — runs everything below, correlates, ranks by severity
attack-surface-recon	What's actually exposed — subdomains, ports, endpoints, tech stack
secrets-scan	Are there leaked keys, tokens, or credentials in git history or the working tree
dependency-audit	Which third-party packages have known CVEs, and what's the fix
sast-code-review	What's wrong with the code itself — injection, unsafe patterns, logic bugs
web-app-pentest	OWASP Top 10 against a running web app — injection, XSS, SSRF, IDOR, access control
api-security-test	Broken auth, mass assignment, BOLA/IDOR, rate limiting on REST/GraphQL APIs
auth-session-security	JWT/session/cookie flaws, fixation, weak MFA, OAuth misconfig
dast-active-scan	Automated black-box scanning of a live target with ZAP/Nuclei
container-image-scan	Vulnerable base images, exposed secrets in layers, bad Dockerfile practices
iac-cloud-posture	Misconfigured Terraform/K8s/cloud resources before or after deploy
network-service-scan	Open ports and exposed services on your own hosts
tls-transport-security	Weak ciphers, expired/misissued certs, protocol downgrade risk
mobile-app-scan	Hardcoded secrets, insecure storage, weak transport in iOS/Android builds
smart-contract-audit	Reentrancy, access control, arithmetic, and known Solidity/Vyper vuln classes
business-logic-fuzzing	Race conditions, workflow bypass, price/quantity manipulation — the stuff scanners miss
ci-cd-pipeline-security	Poisoned pipeline execution, secret exposure, and supply-chain risk in your CI config
findings-report	Turns raw findings into a ranked, remediation-ready writeup

See TOOLS.md for the full inventory of underlying open-source tools each skill drives, and what to install.

We run it on ourselves

This repo scans itself on every push — see .github/workflows/self-scan.yml, which runs secrets-scan (gitleaks) as a hard gate and sast-code-review (semgrep) informationally. It doubles as a copyable CI template that follows the practices in ci-cd-pipeline-security — pinned action SHAs, minimal token permissions, version-pinned scanner image.

Scope

These skills are written for testing things you own, built, or are explicitly authorized to test — your own repos, your own staging/prod environments, your own contracts. Point them at a target, not at the internet at large. See SECURITY.md for responsible-use and safe-findings-handling guidance, and CONTRIBUTING.md to add a skill.

Contributing

New skill = new folder under skills/ with a SKILL.md following the existing frontmatter (name, description). Keep it agent-agnostic: real commands, real tools, no vendor lock-in. PRs welcome.