Quickstart
- 3 installs
- 6.9k repo stars
- Updated August 4, 2026
- anthropics/defending-code-reference-harness
quickstart is a Claude Code skill that orients new operators to the defending-code vulnerability pipeline repo and answers questions from the repo's own docs and source.
About
This skill is the onboarding front door for the defending-code vulnerability pipeline repo. With no argument it gives a short orientation and offers a guided first run on the canary target; with a question it answers from the repo's own docs and source, cites where it looked, and hands the operator the next command. A new operator uses it to get oriented and run threat-model, vuln-scan, and triage on the bundled canary.
- Front door for the defending-code vulnerability-pipeline repo
- Blank invocation gives a 30-second intro and offers a guided first run
- Answers questions from the repo's own docs and source and cites where it looked
Quickstart by the numbers
- 3 all-time installs (skills.sh)
- Ranked #1,752 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
quickstart capabilities & compatibility
- Capabilities
- security audit · vuln scan · documentation
What quickstart says it does
Runs the three Step-1 skills on `targets/canary`, pausing after each to show what landed on disk.
Answer the operator's question using **this repo as ground truth**: README, `docs/*.md`, `harness/*.py`, `targets/*/config.yaml`, `.claude/skills/*`.
npx skills add https://github.com/anthropics/defending-code-reference-harness --skill quickstartAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 3 |
|---|---|
| repo stars | ★ 6.9k |
| Last updated | August 4, 2026 |
| Repository | anthropics/defending-code-reference-harness ↗ |
What it does
Orient a new operator to the defending-code security pipeline repo and walk them through a guided first run on the canary target.
Who is it for?
Getting a new operator oriented and through a Day-1 guided run of threat-model, vuln-scan, and triage on the canary target.
Skip if: Executing target code or running the autonomous vuln-pipeline; the guided run only reads and writes repo files, no sandbox.
When should I use this skill?
For 'how do I...', 'why does...', 'where is...', 'can this...', or just '/quickstart' to get oriented.
What you get
- repo orientation
- guided first run
- cited answers with next command
By the numbers
- 3 Step-1 skills run on the canary (threat-model, vuln-scan, triage)
- 4-day ramp-up table (Day 1 to Week 2)
Files
/quickstart
Two modes, picked by whether $ARGUMENTS is empty.
- Empty → Intro mode. Short orientation, then offer the guided first run.
- Non-empty → Help mode. Treat
$ARGUMENTSas the operator's question.
---
Intro mode
Keep it short and a little warm; this is the first thing a new operator sees.
Say roughly:
Welcome! This repo takes you from finding your first vulnerability to
patching at scale, using a set of Claude Code skills and an autonomous
pipeline. Two ways in: interactive skills (no setup, safe, start here)
and the autonomous pipeline (Docker, scales to hundreds of parallel
agents).
>
The ramp-up:
>
| Day 1 | Threat-model + first static scan + triage |
| Day 2 | Run the reference pipeline (C/C++) |
| Day 3-4 | Customize it for your stack |
| Week 2 | Autonomous scanning, triage, and patching |
>
Day-1 goal: threat-model, scan, and triage the bundled canary target.
Most teams get there before lunch.
Remind them to export CLAUDE_CODE_SUBAGENT_MODEL=<model-id> so subagents use the same model as the session.
Then AskUserQuestion with three options:
1. Walk me through Day 1 on the canary (~10 min) → run "Guided first run" below. 2. I have a question → ask what it is, then switch to Help mode. 3. I'll read the README → point at README.md Step 1 and stop.
Guided first run
Runs the three Step-1 skills on targets/canary, pausing after each to show what landed on disk. These only read/write files in the repo; no sandbox needed.
1. /threat-model bootstrap targets/canary via Task. When done, open THREAT_MODEL.md, show the focus areas, explain in 2-3 sentences how this steers the scan. 2. /vuln-scan targets/canary via Task. When done, open targets/canary/VULN-FINDINGS.md, summarize the count and top 2-3 findings, point at VULN-FINDINGS.json. 3. /triage targets/canary/VULN-FINDINGS.json via Task. When done, open TRIAGE.md, explain what changed vs. raw findings (verified, deduped, re-ranked).
Pause for the operator between each (AskUserQuestion); don't barrel through. Close with a one-line recap of the three artifacts on disk, then point at README Step 2 for the execution-verified pipeline. Never run `vuln-pipeline` or anything that executes target code here; that's Step 2 and needs Docker + a sandbox.
---
Help mode
Answer the operator's question using this repo as ground truth: README, docs/*.md, harness/*.py, targets/*/config.yaml, .claude/skills/*. Don't answer from general knowledge when the repo has a specific answer.
Routing map
| If the question is about… | Read first | Then offer |
|---|---|---|
| running the pipeline | docs/pipeline.md, README Step 2 | the recon / run command |
| too many findings, triage | docs/triage.md | /triage <path> |
| porting, Java/Go/Rust/etc. | docs/customizing.md, README Step 3 | /customize |
| safety, sandbox, Docker | docs/security.md | cite; no action |
| rate limits, 429, token budget | docs/pipeline.md: Rate limits, docs/troubleshooting.md#rate-limits | cite the numbers |
| duplicates, dedup | docs/troubleshooting.md#duplicate-findings | known_bugs: hint |
| CLI flags, "what does --X do" | harness/cli.py (grep the argparse) | exact flag + example |
| which model, subagent pinning | docs/troubleshooting.md: Subagents | the export line |
| best practices, prompting | docs/best-practices.md, docs/prompting.md | cite the principle |
| "how do I start" | README Step 1 | offer Guided first run |
| patching, fix, diff, re-attack | docs/patching.md, README Step 4 | /patch <input> |
| binary, pentest, other domains | docs/other-use-cases.md | cite section |
| anything else | README Table of contents | best-match doc |
Answer format
1. Direct answer in 2-5 sentences. 2. > source: the file(s) and section you used. 3. Next action: one copy-pasteable command or skill invocation, if one applies. If none does, say so. 4. If the question is ambiguous, ask one clarifying question; don't guess.
Constraints
- Never fabricate CLI flags or file paths. If unsure,
Grepfor it in
harness/cli.py or the target configs and quote what you find.
- If the repo doesn't answer the question, say so plainly and suggest the
operator open a GitHub issue on this repo.
- Keep the Q&A dry and cited. Save the warmth for Intro mode.
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does the guided run do?
It runs threat-model, vuln-scan, and triage on targets/canary, pausing after each to show what landed on disk; it never executes target code.
How does help mode answer questions?
It uses the repo as ground truth (README, docs, harness source, target configs) and cites the file and section it used, then offers the next command.