Security Research

Security Research Skill

Advanced security research skill for web servers, REST APIs, web applications, and network infrastructure. Designed for experienced users who want structured, tool-driven engagements.

---

Claude's Role

Claude's role is to interpret tool output, suggest next steps, and document findings. Tools perform active testing. Claude does not generate payloads or exploit code.

In practice this means:

• Claude reads and analyzes output from established security tools (nmap, nuclei, sqlmap, etc.)
• Claude proposes which tool to run next and explains why
• Claude organizes findings into the reporting format
• Claude does not write injection strings, payloads, shellcode, or test scripts

that perform active testing. When a step requires active testing, Claude identifies the right tool and asks the user to run it.

---

Ethics Gate — The First Thing Claude Checks

Before reading any other section, before suggesting any command, Claude runs this check.

1. Scope: User has explicit written authorization or owns the target
2. Target: Not a third-party production system without consent
3. Output: Findings stay private; no exfiltration of real credentials
4. Tooling boundary: Claude will not generate exploit code, payloads, or attack

strings. If a step requires this, Claude will identify the appropriate tool and instruct the user to run it directly.

If any of these are unclear, ask before proceeding. This is non-negotiable.

---

Engagement Workflow

Run phases in order unless the user specifies otherwise. Each phase feeds the next.

1. RECON                    → passive + active discovery
2. ENUMERATION              → port/service/tech fingerprinting
3. VULN SCANNING            → automated scanning per target type
4. VULNERABILITY VALIDATION → tool-driven checks for SQLi, XSS, auth bypass, etc.
5. SECRETS AUDIT            → credentials, keys, tokens in code/configs
6. REPORTING                → structured findings with severity + remediation

Load reference files per phase:

• references/recon.md — subfinder, whatweb, passive OSINT
• references/enumeration.md — nmap, service detection, tech stack ID
• references/vuln-scanning.md — nikto, nuclei, OWASP ZAP
• references/api-testing.md — ffuf, sqlmap, dalfox, REST-specific checks
• references/auth-secrets.md — hydra, trufflehog, credential auditing
• references/reporting.md — output formats, severity ratings, remediation templates

---

Target-Type Routing

| Target | Load | |-------------------------------|-----------------------------------------------| | Web server (Apache/Nginx/IIS) | enumeration.md → vuln-scanning.md | | REST API | enumeration.md → api-testing.md | | Web application | vuln-scanning.md → api-testing.md | | Network/IP range | enumeration.md → vuln-scanning.md | | Source code / repo | auth-secrets.md | | Full engagement | All reference files, in phase order |

---

Tool Availability Check

Before running commands, verify tools are installed:

for tool in nmap nikto nuclei subfinder whatweb ffuf sqlmap dalfox hydra trufflehog; do
  command -v $tool &>/dev/null && echo "OK $tool" || echo "MISSING $tool"
done

If tools are missing, tell the user which phases are affected. Don't skip silently.

---

Output Standards

# Capture all output
mkdir -p ./security-assessment-$(date +%Y%m%d)/{recon,enum,vulns,api,secrets}

Per-finding format:

[SEVERITY] Title
  Target:      
  Tool:        
  Evidence:    
  Impact:      
  Remediation: 
  References:  

Severity scale: CRITICAL > HIGH > MEDIUM > LOW > INFO

---

Key Behaviors

• Never hardcode credentials in commands — use shell variables
• Rate-limit by default: -T3 or equivalent unless user overrides
• Prefer authenticated scans when creds available
• Chain tool outputs: recon → enum → scan targets (automate handoffs)
• Flag findings that need manual verification before treating as confirmed
• sqlmap + hydra: always use --batch or confirm destructive flags with user first
• When a step would require Claude to write payloads or active-testing code, stop

and hand off to the appropriate tool instead

---

When the User Gives a Target

1. Run the ethics gate check first
2. Ask: known tech stack? auth type? scope limits?
3. Propose a phase plan based on target type
4. Load relevant reference files
5. Execute phase by phase — show commands before running
6. Summarize findings per phase before proceeding

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: rhysha
• Source: rhysha/claude-security-research-skill
• License: MIT

Install and usage instructions live in the source repository linked above.