anthropics/defending-code-reference-harness
6 skills2.6k installs41.6k starsGitHub
Install
npx skills add https://github.com/anthropics/defending-code-reference-harnessSkills in this repo
1Threat ModelThis skill builds a threat model for a target codebase, answering what could go wrong, who would do it, and what to do about it. It offers interview mode (walks an owner through a four-question framework), bootstrap mode (derives the model from code plus past vulnerabilities when no owner is available), and a chained mode. It performs static analysis only and writes THREAT_MODEL.md in a shared schema that downstream scan and triage steps consume.885installs2Vuln ScanThis skill runs a static source-code vulnerability scan of a target directory. It reads THREAT_MODEL.md if present, spawns parallel review subagents per focus area covering memory safety, injection, and auth/crypto/data issues, and writes VULN-FINDINGS.json and .md for triage to consume. It is read-only and does not build, run, or reach the network; for execution-verified crashes it points to vuln-pipeline instead.882installs3TriageThis skill triages a batch of raw security findings by verifying each is real, collapsing duplicates, re-ranking survivors by derived exploitability instead of the scanner's claimed severity, and tagging each with a component owner. A user runs it on scanner output between vuln-scan and patch to turn a raw dump into a short, ranked, owned list. It reads source only and never executes target code or reaches the network.872installs4CustomizeThis skill adapts the defending-code C/C++ AddressSanitizer vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. A user runs it when they want to port or fork the pipeline for domains like web apps, smart contracts, deserialization, or ML systems. It reads the existing harness, interviews the user about which parts to swap, and rewrites the relevant prompt and orchestration files.3installs5PatchThis skill is the third leg of the static security pipeline, turning a ranked list of verified findings into candidate diffs. A user runs it after triage to close the loop by generating fixes. It consumes TRIAGE.json, VULN-FINDINGS.json, or a pipeline results directory and writes inert patch files under PATCHES/ for a human to review; by design it never applies a diff to the target repo.3installs6QuickstartThis skill is the onboarding front door for the defending-code vulnerability pipeline repo. With no argument it gives a short orientation and offers a guided first run on the canary target; with a question it answers from the repo's own docs and source, cites where it looked, and hands the operator the next command. A new operator uses it to get oriented and run threat-model, vuln-scan, and triage on the bundled canary.3installs