Security Skills for Claude Code — Open Source Security Automation Toolkit

The open-source security automation toolkit for Claude Code — CTI research, SAST rule generation, secure PRD creation, vulnerability analysis, and AI-powered security engineering workflows. Built by Phoenix Security for the global AppSec, DevSecOps, and security research community.

Search 595+ threat intelligence sources, generate opengrep/semgrep SAST rules for 30+ languages, create security-focused product requirements with STRIDE threat models, review a plan or a codebase before it ships, query NotebookLM for citation-backed research, and auto-generate living project documentation — all from your terminal with Claude Code.

---

Install in 30 seconds

Everything in this repository installs as six Claude Code plugins from one marketplace. Paste this into Claude Code:

/plugin marketplace add Security-Phoenix-demo/security-skills-claude-code
/plugin install phoenix-security-review@phoenix-security
/plugin install phoenix-readiness-reviews@phoenix-security
/plugin install phoenix-sast-rules@phoenix-security
/plugin install phoenix-cti-search@phoenix-security
/plugin install phoenix-prd-pipeline@phoenix-security
/plugin install phoenix-docs-research@phoenix-security

Install only the plugins you want — each one stands alone. Full detail, team-wide auto-install, and troubleshooting: Marketplace Installation Guide.

---

New — Readiness Review Gates

Two adversarial review gates that answer the two questions that actually decide whether work is ready to move: is the plan implementable, and is the code actually shippable.

Both refuse to hand you an invented number. Percentages carry counts (68% (23/34 VERIFIED)), results are three-state (VERIFIED / GAP / UNVERIFIABLE) so “I could not check this” stops collapsing into a pass, and every absence claim must cite the search that returned zero hits. production-readiness-review runs a deterministic repo scanner first, so its evidence is reproducible and two runs diff cleanly instead of depending on what the model happened to read.

/plugin install phoenix-readiness-reviews@phoenix-security

Then just ask — or type /plan-readiness-review / /production-readiness-review. Full reference: Readiness & Review Gates.

---

Table of Contents

• Install in 30 seconds
• New — Readiness Review Gates
• Powered by Phoenix Security — Open-Source Companion to the Platform
• What Is This Repository?
• What’s Included
  • The six plugins
  • All 27 skills
  • Feature Descriptor — Phoenix Pipeline
• Quick Start
• Repository Structure
• Readiness & Review Gates
• Research & Intelligence Skills
  • 1. CTI Domain Research
  • 2. NotebookLM Connector
  • 3. Global Research Pipeline
• Security Generation & Remediation Skills
  • 1. Secure PRD Generator
  • 2. OpenGrep Rule Generator
  • 3. OpenGrep Rule Generator Research
  • 4. Project Documentation
  • 5. Security Assessment Suite
• Plugins Reference
  • CTI Search Plugin
  • Secure PRD Plugin
• Phoenix Pipeline — Feature Descriptor
• Domain Tiers
• NotebookLM Integration
• Configuration
• Contributing
• Frequently Asked Questions (FAQ)
• License
• Support
• Acknowledgments

---

Overview

---

Powered by Phoenix Security — Open-Source Companion to the Platform

This repository is the open-source companion to the Phoenix Security platform. Each skill here distills a slice of what Phoenix does at platform scale into something you can run locally inside Claude Code. If a skill earns its keep in your workflow and you need it across hundreds of repos, with real reachability data, exploit chains, and team-level SLAs, the corresponding Phoenix product area is where to go next.

Phoenix Platform — Four Unified Product Areas

When the open-source skills aren’t enough:

• Need cross-repo reachability and prioritization? → Phoenix Orange
• Need multi-step taint analysis with real exploit chains? → Phoenix Purple
• Need adversarially validated CVE intel + install-time blocking? → Phoenix Blue
• Need agentic remediation with measurable risk reduction? → Phoenix Green

The skills in this repo are designed to be useful on day one, with no Phoenix backend required. They share Phoenix’s design philosophy: short feedback loops, severity-ranked findings, no padding, no 30-page reports.

---

What Is This Repository?

This repository is a curated collection of security skills, plugins, and automation pipelines for Claude Code — Anthropic’s official CLI for AI-assisted software engineering. It turns Claude Code into a comprehensive security engineering workstation capable of threat intelligence research, vulnerability detection rule generation, secure requirements engineering, and automated security documentation.

Built and maintained by the security engineering team at Phoenix Security and released as open source under the MIT License. Every skill is designed for real-world security workflows: incident response research, AppSec shift-left, SAST pipeline creation, compliance documentation, and security architecture review.

Built for security professionals who use AI to work faster and more accurately:

• Security engineers and SOC analysts — automate CTI gathering across 595+ sources with authority-ranked results and MITRE ATT&CK mapping
• DevSecOps teams — generate security-focused PRDs with STRIDE threat models before writing a single line of code
• AppSec professionals — create opengrep/semgrep SAST rules for 30+ languages with built-in false positive reduction and CWE/OWASP tagging
• Vulnerability researchers — research CVEs with web search, then auto-generate detection rules grounded in real exploit data
• Penetration testers and red teamers — gather OSINT and push findings to NotebookLM for citation-backed analysis
• Engineering managers — auto-generate living project documentation with architecture maps, dependency views, and self-healing CI
• Anyone using Claude Code — extend your terminal with structured, repeatable security automation workflows

---

What’s Included

The six plugins

Everything ships as a Claude Code plugin. One /plugin install per plugin — no copying folders, no editing settings by hand. Each plugin holds one or more skills; a skill is an instruction-based workflow that also gives you a slash command of the same name.

All 27 skills

Each one is also a slash command named after it.

Feature Descriptor — Phoenix Pipeline

The Phoenix Pipeline is a 12-role specification system for producing rigorous, security-aware product requirements. Each role is a dedicated skill file.

All 12 roles ship inside the phoenix-prd-pipeline plugin: plugins/phoenix-prd-pipeline/skills/. Install it once and every role is available as a skill and a slash command.

---

Quick Start

Prerequisites

• Claude Code installed
• Node.js 18+ (for plugins)
• A search API key — Brave Search (recommended, 2,000 free requests/month) or SerpAPI (100 free/month)

Installation

Method 1 — plugin marketplace (recommended)

One marketplace, six plugins. Type these in Claude Code:

/plugin marketplace add Security-Phoenix-demo/security-skills-claude-code
/plugin install phoenix-security-review@phoenix-security
/plugin install phoenix-readiness-reviews@phoenix-security
/plugin install phoenix-sast-rules@phoenix-security
/plugin install phoenix-cti-search@phoenix-security
/plugin install phoenix-prd-pipeline@phoenix-security
/plugin install phoenix-docs-research@phoenix-security

Install only what you need. /plugin opens the browser UI if you would rather click.

Prefer the terminal? The same thing works outside a session:

claude plugin marketplace add Security-Phoenix-demo/security-skills-claude-code
claude plugin install phoenix-readiness-reviews@phoenix-security
claude plugin list

Team-wide auto-install — commit this to your repo’s .claude/settings.json and every teammate gets the plugins on their next session:

{
  "extraKnownMarketplaces": {
    "phoenix-security": {
      "source": {
        "source": "github",
        "repo": "Security-Phoenix-demo/security-skills-claude-code"
      }
    }
  },
  "enabledPlugins": {
    "phoenix-security-review@phoenix-security": true,
    "phoenix-readiness-reviews@phoenix-security": true
  }
}

Updating later: /plugin update phoenix-security-review@phoenix-security, or /plugin marketplace update phoenix-security to refresh the catalogue.

See the Marketplace Installation Guide for troubleshooting, scopes, and how to test a local checkout before you push.

Method 2 — local checkout (for development)

Point the marketplace at a directory instead of a repo. Edits land immediately, so this is the loop to use while writing or changing a skill:

git clone https://github.com/Security-Phoenix-demo/security-skills-claude-code.git
cd security-skills-claude-code
claude plugin marketplace add "$(pwd)"
claude plugin install phoenix-readiness-reviews@phoenix-security

Validate before you commit:

claude plugin validate .                                   # the marketplace manifest
claude plugin validate plugins/phoenix-security-review     # one plugin manifest
claude plugin validate --strict plugins/phoenix-security-review  # its skills, commands, agents
python3 scripts/validate-marketplace.py                    # does everything fit together?

Method 3 — copy a single skill

A skill directory is self-contained. Copy one in and it becomes a slash command named after the directory, with no manifest needed:

# personal — available in every project on this machine
cp -r plugins/phoenix-readiness-reviews/skills/* ~/.claude/skills/

# or project-scoped, committed so the team gets it
cp -r plugins/phoenix-readiness-reviews/skills/* .claude/skills/

Claude Code watches these directories, so an edit lands in the running session without a restart. Note that ~/.claude/skills/ is not read by Cowork or cloud sessions — use the plugin route for those.

After installing — Node and API keys

Only phoenix-cti-search needs either. Its cti-domain-research skill works with no setup; the bundled CLI and MCP server need Node 18+ and a search key:

CTI=~/.claude/plugins/marketplaces/phoenix-security/plugins/phoenix-cti-search
cd "$CTI" && npm install --omit=dev
cp .env.example .env   # then set BRAVE_SEARCH_API_KEY

---

Repository Structure

security-skills-claude-code/
│
├── .claude-plugin/
│   └── marketplace.json                   # the marketplace manifest — this is what
│                                          # /plugin marketplace add reads
│
├── README.md                              # this file — start here
├── MARKETPLACE_INSTALL.md                 # installation guide + troubleshooting
├── CONTRIBUTING.md                        # how to add a skill or a plugin
├── LICENSE                                # MIT
│
└── plugins/                               # one directory per plugin
    │
    ├── phoenix-security-review/           # 6 skills, 4 commands, 1 agent, 3 hooks
    │   ├── .claude-plugin/plugin.json
    │   ├── skills/
    │   │   ├── security-reviewer/         # canonical multi-language reviewer
    │   │   │   ├── languages/             # 7 per-language reference packs
    │   │   │   ├── checklists/            # OWASP/ASVS + endpoint
    │   │   │   └── playbooks/triage.md
    │   │   ├── security-assessment/       # whole-repo OWASP + ASVS L1
    │   │   ├── 0day-scanner/              # diff-scoped exploit analysis
    │   │   ├── threat-modeling/           # STRIDE + DREAD
    │   │   ├── tm-quick-security-assessment/
    │   │   └── tm-security-review/
    │   ├── commands/                      # /security-review /security-0day
    │   │                                  # /security-audit /threatmodel
    │   ├── agents/security-reviewer.md    # the review subagent
    │   ├── hooks/                         # SessionStart / PreToolUse / PostToolUse
    │   ├── install/                       # opt-in hook wiring, Windsurf, Codex
    │   └── references/                    # tester templates, suite notes
    │
    ├── phoenix-readiness-reviews/         # 2 skills
    │   ├── .claude-plugin/plugin.json
    │   └── skills/
    │       ├── plan-readiness-review/
    │       │   └── references/            # ambiguity patterns, output template
    │       └── production-readiness-review/
    │           ├── references/            # verification checklists, output template
    │           └── scripts/scan_repo.sh   # deterministic evidence collector
    │
    ├── phoenix-sast-rules/                # 2 skills
    │   └── skills/
    │       ├── opengrep-rule-generator/
    │       └── opengrep-rule-generator-research/
    │
    ├── phoenix-cti-search/                # 2 skills + CLI + MCP server
    │   ├── skills/cti-domain-research/
    │   ├── commands/cti-search.md
    │   ├── index.js                       # CLI entry point
    │   ├── mcp-server.js                  # MCP tool server
    │   ├── data/domains.txt               # 595 curated security domains
    │   └── data/tier-map.json             # tier + authority scores
    │
    ├── phoenix-prd-pipeline/              # 13 skills
    │   ├── skills/prd-generator/          # one-shot PRD + threat model
    │   ├── skills/phoenix-*/              # the 12 pipeline roles
    │   └── dist/claude-ai-web/            # the Claude.ai web UI variant
    │
    └── phoenix-docs-research/             # 3 skills
        ├── skills/project-documenter/     # 6 modes, incl. self-heal
        ├── skills/notebooklm/             # browser automation + scripts
        ├── skills/phoenix-research-pipeline/
        └── docs/                          # per-skill long-form docs

Every dist/ directory holds the packaged .skill bundles for uploading to claude.ai — they are distribution artefacts, not something Claude Code loads.

---

Readiness & Review Gates

Plugin: plugins/phoenix-readiness-reviews/ · /plugin install phoenix-readiness-reviews@phoenix-security

Two gates, split by what is under review. Run the plan gate before build. Run the production gate before merge or release. The production gate assumes the plan exists but never trusts it.

Left: every input the plan gate accepts, the gaps it hunts for, and the READY / NOT READY decision. Right: what the production gate proves against the real repository, and the SHIP / NO-SHIP decision. Bottom: where each gate sits in the workflow, and the three-state evidence model both share.

1. Plan Readiness Review — Catch the Gap Before Anyone Writes Code

One question decides everything: could a competent senior engineer who was not in any of the meetings implement this correctly, without inventing anything? Anything an implementer would have to decide for themselves is a gap in the plan, not a detail for later — a guess is an unreviewed product decision made by whoever happened to pick up the ticket.

What it produces:

• A requirement inventory with stable IDs, so a re-run reports a delta and not a fresh list.
• A per-requirement verdict backed by a document anchor you can go and read.
• An unresolved-assumption register — the decisions nobody has actually made yet.
• A counted READY / NOT READY, and the precise change that would flip it.

It reads a bundled ambiguity-pattern reference during the review: the specific phrasings that reliably survive plan review and then produce two engineers building two different things. Undefined magnitude, undefined actor, undefined scope of “all”, verbs that hide a design decision, error-handling non-statements.

Example prompts:

/plan-readiness-review docs/payments-prd.md
review this spec before we build it
is this ready to implement?
poke holes in this plan
will an engineer know what to build from this?

2. Production Readiness Review — Try to Disprove That the Work Is Done

The plan is a claim. The commit history is a claim. A passing test suite is a weaker claim than it looks. Only the code, its wiring, its configuration and its behaviour under failure are evidence. This skill tries to disprove that the work is finished and reports what survived the attempt.

Phase 1 is a deterministic scan. scripts/scan_repo.sh emits path:line for every hit, under seven sections: incompleteness markers, silent failure and swallowed errors, debug and dev leftovers, security surface (secret-shaped literals, routes counted against auth markers, injection-prone patterns, disabled TLS checks), config/flags/migrations/deploy including which artefacts are missing, test surface, and the change surface vs a base ref. It skips test paths and vendor directories, needs only bash and grep, and uses ripgrep when present. Output is deterministic, so two runs diff cleanly and the review’s evidence is reproducible rather than dependent on what the model happened to read.

The scanner is useful on its own:

SKILL=~/.claude/plugins/marketplaces/phoenix-security/plugins/phoenix-readiness-reviews/skills/production-readiness-review
bash "$SKILL/scripts/scan_repo.sh" /path/to/repo --base origin/main > scan.md
bash "$SKILL/scripts/scan_repo.sh" . --base main --exclude 'generated/'

What the review then does with those leads:

• Traces every requirement end to end — UI, API, service, persistence, jobs, config, migrations, deploy. Wiring gets its own pass, with a named list of the “exists but is dead” traps.
• Checks test integrity by breaking the code and confirming a test fails, instead of trusting test counts and coverage percentages.
• Runs per-domain security checks with required evidence for each, not one bullet labelled “security”.
• Separates audit from remediation with a hard gate. Fixing while auditing destroys the record of what actually shipped. Remediation runs only when you authorise it, and only up to the severity you name.
• Ranks issues by a severity rubric rather than intuition, with stable IDs.

Example prompts:

/production-readiness-review
is this actually implemented?
verify the implementation against the PRD
pre-merge review of this branch vs origin/main
ship or no-ship?

What comes back — a counted Verdict block first, then the blocking issues:

## Verdict

**PRODUCTION READY: NO**

- Plan completeness: **91%** (31 READY / 34 requirements)
- Implementation completeness: **74%** (25 VERIFIED / 34; 7 GAP, 2 UNVERIFIABLE)
- Open issues: 1 Critical, 3 High, 5 Medium, 2 Low
- Scope: repo `.` @ `a1b2c3d` vs base `origin/main`; plan `payments-prd.md v1.4`
- Verdict rule applied: NO-SHIP while any Critical or High is open

## Blocking issues

- P-001 [Critical] `GET /v1/findings/{id}` has no tenant check — findings/api.py:212
- P-004 [High] refund handler catches and drops every exception — billing/refund.py:88

Then the per-requirement inventory, the remaining work with owners, and an evidence log of what was actually executed — so the review’s limits are visible rather than implied.

Why the verdicts are trustworthy

---

Research & Intelligence Skills

Skills that gather, organize, and verify external knowledge — threat intel, vendor docs, vulnerability research — and feed it into your workflow with citation-backed accuracy.

1. CTI Domain Research — Automated Threat Intelligence Gathering

Folder: plugins/phoenix-cti-search/skills/cti-domain-research/

Stop manually searching BleepingComputer, Krebs on Security, and vendor blogs one tab at a time. The CTI Domain Research skill transforms Claude Code into a structured threat intelligence platform that searches 595+ curated security domains in seconds — covering government advisories, vendor research labs, security news, and OSINT sources in a single query.

The skill uses a four-tier authority ranking system to ensure the most trustworthy sources surface first. When you search for a CVE, it automatically prioritizes CISA, NVD, and MSRC (Tier 1) before checking Unit42, Talos, and Securelist (Tier 2). Threat actor queries route to vendor research blogs first. Exploit searches hit GreyNoise, VulnCheck, and AttackerKB. Every result is deduplicated, scored by source authority and recency, and returned as a structured CTI brief with extracted CVE IDs, MITRE ATT&CK technique mappings, and observed IOCs.

The optional --notebooklm flag pushes all discovered source URLs directly into a Google NotebookLM notebook, creating a permanent, citation-backed research archive that you can query later with zero hallucination risk. This turns a one-off search into a reusable knowledge base.

Example prompts:

Search for threat intelligence on CVE-2024-21762
Find recent LockBit ransomware reports across vendor blogs
What are security vendors saying about ALPHV BlackCat?
Research MITRE T1190 exploitation techniques and push to NotebookLM
Collect CTI on supply chain attacks targeting npm packages

How it works:

1. Query classification — automatically detects whether you’re searching for a CVE, threat actor, malware family, exploit, or general topic
2. Intelligent tier routing — selects the most relevant domain tiers based on query type
3. Batched site-scoped search — constructs site: queries across domain batches using Brave Search or SerpAPI
4. Authority-ranked deduplication — removes duplicates, scores results by source tier and recency
5. IOC and TTP extraction — pulls CVE IDs, MITRE ATT&CK T-IDs, and IP indicators from result snippets
6. Structured output — returns a CTI brief with key findings, source table, observed tags, and next steps

---

2. NotebookLM Connector — Source-Grounded AI Research with Zero Hallucinations

Folder: plugins/phoenix-docs-research/skills/notebooklm/

LLM-based security research has a fundamental problem: hallucinations. When Claude can’t find something in your uploaded documents, it fills the gap with plausible-sounding but potentially incorrect information — a dangerous failure mode when you’re writing detection logic, threat models, or security requirements. The NotebookLM Connector solves this by routing questions through Google NotebookLM, which answers exclusively from your uploaded documents with strict citation backing.

Every response from NotebookLM is grounded in the specific documents you’ve uploaded — PDFs, Google Docs, websites, GitHub repos, YouTube videos. If the information isn’t in your sources, NotebookLM says so instead of inventing an answer. This makes it the ideal research backend for security work where accuracy is non-negotiable: vulnerability analysis, compliance documentation, API specification lookups, and threat model validation.

The skill manages a notebook library so Claude automatically selects the right notebook for your question. Ask about authentication best practices and it routes to your security-docs notebook. Ask about API endpoints and it hits your architecture notebook. Each question runs in a fresh browser session with persistent authentication, and the built-in follow-up mechanism ensures Claude asks comprehensive questions until the research is complete.

Capabilities:

• Query any NotebookLM notebook by ID or URL with citation-backed responses
• Smart notebook library management — add, remove, list, search, activate/deactivate notebooks
• Automatic content discovery — query a notebook to auto-populate its metadata before saving
• Browser automation with persistent Google authentication
• Iterative follow-up queries to build comprehensive understanding
• Coverage analysis to ensure all parts of your question are fully answered

Example prompts:

Query my security-docs notebook about authentication best practices
Add this NotebookLM URL to my library: https://notebooklm.google.com/notebook/abc123
What does my threat-model notebook say about SSRF risks?
Check my API docs for rate limiting implementation details
Search my notebooks for information about OAuth2 token rotation

Key files:

• SKILL.md — skill specification with decision flow and follow-up mechanism
• README.md — comprehensive setup guide with architecture diagram and examples
• AUTHENTICATION.md — step-by-step Google authentication setup
• scripts/ — Python automation scripts (ask_question.py, notebook_manager.py, auth_manager.py)
• references/ — API reference, troubleshooting guide, usage patterns

---

3. Global Research Pipeline — Automated Intelligence Collection and Ingestion

Folder: plugins/phoenix-docs-research/skills/phoenix-research-pipeline/

Individual searches give you snapshots. The Global Research Pipeline gives you systematic coverage. This skill orchestrates a multi-module research automation pipeline that collects intelligence from web searches and YouTube video transcripts, deduplicates and organizes findings, and pushes everything into Google NotebookLM for permanent, source-grounded querying.

The pipeline is designed for deep-dive research scenarios where you need to gather comprehensive intelligence on an emerging threat, a new vulnerability class, or a complex security topic. Instead of running individual searches and manually copying results, the pipeline handles the entire workflow: systematic data collection across web and video sources, automated deduplication, structured formatting, and batch ingestion into your NotebookLM research archive.

This creates a repeatable research-to-analysis pipeline: search → collect → deduplicate → ingest → query. Once findings are in NotebookLM, you can ask follow-up questions with full citation backing, cross-reference information across sources, and build on previous research without re-running searches.

Pipeline stages:

1. Web research — structured searches across relevant domains with finding extraction
2. YouTube research — locate and transcribe relevant video content (conference talks, vendor webinars, researcher presentations)
3. Deduplication and organization — remove duplicates, structure results for ingestion
4. NotebookLM push — batch-add all collected sources to your target notebook
5. Downstream querying — use the NotebookLM Connector skill to query your research with zero hallucination

Example prompts:

Research the latest ransomware trends and push findings to NotebookLM
Collect comprehensive intelligence on supply chain attacks targeting Python packages
Research cloud security misconfigurations across AWS, GCP, and Azure

---

Security Generation & Remediation Skills

A focused set of skills that generate, audit, or remediate security issues across the SDLC — shifting security left into requirements, generating SAST detection rules from CVE/CWE research, documenting security-relevant architecture, and running diff-time / pre-merge / pre-release / design-time AppSec workflows on the codebase. Together they cover the full lifecycle from spec to ship.

1. Secure PRD Generator — Shift Security Left to the Requirements Stage

Folder: plugins/phoenix-prd-pipeline/skills/prd-generator/

Traditional PRDs focus exclusively on features and leave security as an afterthought — discovered too late in testing, patched as a hotfix, or never addressed at all. The Secure PRD Generator integrates security into the requirements phase itself, running every feature description through a 10-role specification pipeline that produces RFC 2119-compliant requirements with STRIDE threat models, abuse cases, and verification proof paths built in from the start.

Each role in the pipeline handles a specialized aspect of specification: the Context Curator cleanses and structures the input; the Ambiguity Hunter flags vague instructions that cause downstream design flaws; the Requirements Engineer formalizes requirements with MUST/SHOULD/MAY levels and structured IDs (R-FUNC-001, R-SEC-001); the Security Engineer develops comprehensive threat models and abuse cases alongside the functional requirements; and the Verification Matrix creates concrete proof paths for every MUST-level requirement to ensure full testability.

The skill integrates directly with your team’s existing tools. It publishes the PRD to Atlassian Confluence via MCP, converts requirements into Linear or Asana tasks automatically, sends Slack notifications to stakeholders, mirrors documents to Notion, and drafts summary emails via Gmail. Every output follows a consistent security-first template with priority tags (P0/P1/P2) and traceable requirement chains.

What it produces:

• Security-first PRD in structured markdown with RFC 2119 requirement levels
• STRIDE threat model with identified assets, actors, entry points, and trust boundaries
• Cursor-compatible implementation plan for .cursor/plans/
• Confluence page published to your configured space
• Automated task distribution to Linear or Asana from the batch plan
• Stakeholder notifications via Slack and Gmail

Example prompts:

Write a PRD for a user authentication system with OAuth2 and MFA
Create a security-focused spec for a payment processing API
Plan this feature: real-time webhook delivery system. Owner: @jane. Space: ENG.
Generate requirements for a file upload service with virus scanning

---

2. OpenGrep Rule Generator — AI-Powered SAST Rule Creation

Folder: plugins/phoenix-sast-rules/skills/opengrep-rule-generator/

Writing effective SAST rules is slow, error-prone, and requires deep knowledge of both the vulnerability class and the rule engine’s syntax. The OpenGrep Rule Generator automates the entire process — from vulnerability description to validated, production-ready opengrep/semgrep YAML rules with test cases, CWE metadata, and false positive reduction patterns.

The skill supports 30+ programming languages including Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C#, Rust, Kotlin, Swift, Terraform/HCL, and Solidity. It generates two types of rules: Search rules for structural pattern matching (finding dangerous function calls, insecure configurations, hardcoded secrets) and Taint rules for data flow analysis (tracing untrusted input from sources through propagators to dangerous sinks, with sanitizer awareness).

Every generated rule includes built-in false positive reduction using pattern-not, pattern-not-inside, and metavariable-regex patterns. The skill also generates companion test files with clearly marked true positive and true negative cases so you can validate detection accuracy before deploying to your CI pipeline.

Two workflows:

• Guided Discovery — interactive Q&A where Claude asks about your codebase, frameworks, and threat model before generating targeted rules
• Vulnerability-Driven — provide a CVE, CWE, or OWASP category and get rules generated automatically with appropriate detection patterns

Example prompts:

Create an opengrep rule to detect SQL injection in Python Flask apps
Generate a taint analysis rule for XSS in React components
Write semgrep rules for OWASP Top 10 in Java Spring Boot
Detect hardcoded AWS credentials in any language
Build a rule to catch insecure deserialization in Python pickle usage
Generate Terraform rules to detect publicly exposed S3 buckets

Key files:

• SKILL.md — full skill specification with guided and vulnerability-driven workflows
• RULES_SYNTAX.md — comprehensive opengrep/semgrep syntax reference (patterns, operators, metavariables, taint mode)
• OPENGREP_RULE_GENERATOR_PROMPT.md — optimized system prompt for high-quality rule generation

---

3. OpenGrep Rule Generator Research — Vulnerability-First Detection Engineering

Folder: plugins/phoenix-sast-rules/skills/opengrep-rule-generator-research/

The standard OpenGrep Rule Generator works great when you already know the pattern you want to detect. But what if you’re starting from a CVE advisory, a vulnerability class, or a vague report about a new attack technique? The Research variant adds a 4-phase vulnerability research pipeline that uses web search and web fetch to study the vulnerability in depth before generating detection rules — producing significantly better, more targeted rules that are grounded in real-world exploit data.

This is the difference between writing a rule from a description and writing a rule from understanding. The research phase studies official advisories, analyzes proof-of-concept exploits, maps language-specific attack surfaces (sources, sinks, sanitizers, propagators), and reviews existing semgrep/opengrep rules to identify coverage gaps. The resulting rules are inherently linked to real exploit behavior, not abstract patterns.

Research pipeline (4 phases):

1. Vulnerability deep dive — search CVE/CWE databases, fetch CISA/NVD/MSRC advisories, study proof-of-concept exploits to understand the actual attack mechanics
2. Attack surface mapping — identify specific sources, sinks, and certifiers for the target programming language based on the researched exploit behavior
3. Existing detection gap analysis — search for existing semgrep/opengrep rules, analyze what they catch and miss, identify coverage blind spots
4. Grounded rule generation — generate SAST rules that are directly linked to the researched exploit patterns, with a research summary embedded in each rule file

Example prompts:

Research CVE-2024-21762 and create detection rules for it
Generate opengrep rules for CWE-89 (SQL Injection) in Python with full research
Investigate Log4Shell and build comprehensive detection coverage for Java
Research SSRF vulnerabilities in Node.js and create taint analysis rules
Study the MOVEit Transfer vulnerability and write detection rules

When to use this vs. the standard OpenGrep Rule Generator:

• Use OpenGrep Rule Generator when you already know the exact code pattern you want to detect
• Use OpenGrep Rule Generator Research when you’re starting from a CVE ID, CWE class, or vulnerability description and need to understand the attack before building detection

---

4. Project Documentation — Turn Any Codebase into Living Documentation

Folder: plugins/phoenix-docs-research/skills/project-documenter/

Documentation drift is the silent killer of engineering velocity. Code evolves daily while docs go stale within weeks, creating security blind spots, tribal knowledge silos, and painful onboarding experiences. The Project Documenter skill reverse-engineers your entire codebase and produces a three-layer hierarchical documentation system that stays accurate because it’s generated from the code itself.

The skill produces a compressed DOC_INDEX.md routing layer (~1-2k tokens, perfect for AI assistants), an engineering CLAUDE.md navigation map (150-300 lines for human developers), and a complete set of /docs/ sub-documents containing all authoritative detail — architecture diagrams, dependency maps, API references, module guides, runtime flow descriptions, and onboarding walkthroughs. Nothing is duplicated across layers.

Available in six modes to match your needs: Express (full pack, zero questions), General (developer-facing docs), AI/LLM (prompt inventories, model architecture, agent safety), Architecture (system maps, data contracts, dependency graphs), Full (everything plus audit of existing docs), and Self-Heal (generates GitHub Actions CI, Cursor rules, and Python drift-detection scripts to keep docs permanently in sync with code changes).

Output artifacts:

• Project Summary — high-level overview of system purpose and function
• Architecture Diagram — visual mapping of system components and data flow
• Dependency View — comprehensive list and map of third-party libraries and internal links
• Service/Component Map — structural breakdown of project organization
• Onboarding Document — guided walkthrough for new developers and auditors
• Self-Heal CI (Mode 5) — GitHub Actions workflow + Python scripts that detect documentation drift automatically

Example prompts:

Document this project (Express mode — full pack, zero questions)
Generate architecture documentation for this codebase
Create AI/LLM documentation including prompt inventory and model guardrails
Set up self-healing documentation with GitHub Actions CI

Key files:

• project-documenter.skill — full skill definition (install in Claude.ai or Claude Code)
• project-documenter-simpler.skill — lightweight variant for quick documentation
• HOW_IT_WORKS.md — complete technical reference
• MODES_REFERENCE.md — detailed guide to every mode and its outputs
• INSTALL.md — step-by-step installation and first-run guide
• TROUBLESHOOTING.md — common issues and fixes

---

5. Security Assessment Suite — Four AppSec Skills + Active Hooks

Folder: plugins/phoenix-security-review/ — see the suite README for the full reference.

A self-contained AppSec automation kit: four slash commands covering the security lifecycle from diff-time to design-time, a multi-language pre-merge reviewer with subagent dispatch, four hooks (SessionStart, PreToolUse, PostToolUse, SessionEnd) that feed live security context to every agent, and a one-command installer that wires it all into Claude Code, Windsurf, or Codex.

The four commands (when to use each):

Two more skills come with the plugin and have no command of their own — ask for them by name, or let Claude pick them up from the request: tm-quick-security-assessment (quick tier — a threat-model-aware pass over only what changed vs a base ref) and tm-security-review (comprehensive tier — build the full STRIDE model, then a triple-pass HUNT → JUDGE → VERIFY exploit review that proves a runnable PoC per confirmed finding).

Active hooks (full preset only — opt out for the lite preset):

• SessionStart fingerprints the project, runs a fast dependency audit (osv-scanner if installed, else npm/pip/cargo/go/bundle audits per ecosystem), and injects a ## SECURITY CONTEXT block every agent reads before its first turn.
• PreToolUse on Bash gates npm/yarn/pnpm/pip/uv/poetry/cargo/go get/gem/bundle/composer/dotnet add invocations. Blocks known-malicious packages, asks on typosquats and brand-new packages.
• PostToolUse on Edit|Write|MultiEdit runs a fast pattern scan on every file write (SQL string formatting, innerHTML, hardcoded secrets, etc.) and feeds findings back via additionalContext.
• SessionEnd prints a one-line reminder to run /security-0day if your branch has unscanned changes vs main. Zero LLM cost.

The hooks are opt-in. Installing the plugin gives you the six skills, the four slash commands and the subagent immediately. The three active hooks are not wired automatically, because a PreToolUse gate on every Bash call and a scan on every file write should be your decision, not a side effect of installing a plugin.

To wire them, run the bundled installer from your project root:

PLUGIN=~/.claude/plugins/marketplaces/phoenix-security/plugins/phoenix-security-review
bash "$PLUGIN/install/install.sh" --full

The installer:

1. Copies the four slash commands into .claude/commands/.
2. Merges the chosen hook preset into .claude/settings.json (uses jq if available; backs up your existing settings first; tracks installer-created files so --uninstall is clean).
3. Copies the security-reviewer subagent into .claude/agents/ (full preset only).
4. Chmods all hook scripts.

Variants:

• install.sh (default) or install.sh --lite — slash commands + SessionEnd reminder hook only. Zero LLM cost.
• install.sh --full — everything in lite plus the three active hooks plus the subagent.
• install.sh --dry-run [--lite|--full] — preview without writing.
• install.sh --uninstall — remove commands + subagent, restore .claude/settings.json from the backup.

Other tools:

• Windsurf — cp a rule into .windsurf/rules/ (auto-fires on endpoint/auth/render/dep changes) and two workflows (/security-assessment, /threatmodel) into .windsurf/workflows/. One-line install in the suite README.
• Codex CLI — cat the AGENTS.md.snippet onto your project’s AGENTS.md. Codex has no hook system, so this is enforced as a behavioral instruction.

Optional dependencies:

• jq — recommended for clean settings.json merge (installer falls back to copy-paste instructions if absent).
• ripgrep — required by the post-edit-quickscan hook (already required by Claude Code itself).
• osv-scanner — optional; richer dependency audit at SessionStart. brew install osv-scanner or go install github.com/google/osv-scanner/cmd/osv-scanner@latest.

Example prompts:

/security-0day                         # scan diff vs main with the LLM 0-day scanner
/security-0day origin/release-1.4      # scan diff vs a different base ref
/security-review auth                  # 8-point check focused on auth surfaces
/security-audit backend                # full OWASP/ASVS sweep, backend only
/threatmodel src/payments/             # STRIDE + DREAD threat model for the payments component

When the four skills overlap (and how to pick):

Are you reviewing a specific diff/PR/commit?
├── Yes → /security-0day
└── No → Did the change touch endpoints/auth/render/deps/config?
        ├── Yes → /security-review
        └── No → Pre-release / quarterly audit?
                ├── Yes → /security-audit
                └── No → New feature / architecture design?
                        ├── Yes → /threatmodel
                        └── No → You probably don't need this suite right now.

Key files (all paths relative to plugins/phoenix-security-review/):

• README.md — suite overview, decision tree, hook reference, subagent details, cross-skill integration diagram, troubleshooting.
• skills/security-reviewer/ — the canonical multi-language reviewer: the 8-point check, 7 per-language reference packs in languages/, OWASP/ASVS + endpoint checklists in checklists/, and a triage playbook in playbooks/. Also the on-disk fallback for security-assessment and 0day-scanner when their MCP tools are unreachable.
• commands/ — the four slash command definitions (each a thin wrapper over a skill).
• agents/security-reviewer.md — the review subagent.
• hooks/ — the three hook scripts plus lib/common.sh.
• install/install.sh — the opt-in hook installer.
• install/hooks/settings.{lite,full}.example.json — ready-to-merge .claude/settings.json blocks.
• install/windsurf/ — Windsurf rule + workflows.
• install/codex/AGENTS.md.snippet — Codex behavioural instruction.
• references/security-analysis-agent/ — parameterised backend/frontend tester templates with {{PLACEHOLDERS}} (hydrate before use).

---

Plugins Reference

1. CTI Search Plugin

Folder: plugins/phoenix-cti-search/

The execution engine behind CTI searches. Available as a CLI tool, MCP server, or slash command.

Usage Modes

Slash command:

/cti-search CVE-2024-21762
/cti-search LockBit ransomware --full --since 30
/cti-search ALPHV --notebooklm --tier 2

CLI:

node index.js --query "CVE-2024-21762" --full
node index.js --query "LockBit" --tier 2 --since 30 --notebooklm
node index.js --query "supply chain attack npm" --json

MCP tool (conversational):

Use the CTI search tool to find recent ransomware reports

Flags

---

2. Secure PRD Plugin

Folder: plugins/phoenix-prd-pipeline/dist/claude-ai-web/

Generates security-focused Product Requirements Documents and integrates with external project management tools:

• Atlassian Confluence — publishes PRD as a page
• Linear / Asana — creates tasks from requirements
• Slack — sends notifications on PRD completion
• Notion — mirrors the PRD
• Gmail — drafts stakeholder emails

---

Phoenix Pipeline — Feature Descriptor

Folder: plugins/phoenix-prd-pipeline/skills/

The Phoenix Pipeline is a 12-role specification system that breaks down feature requirements into discrete, expert-reviewed stages. Each role is a standalone .skill file that can be used independently or orchestrated together.

How It Works

Input (feature request / brief)
  │
  ├─→ Context Curator         — extract and cleanse context
  ├─→ Scope Cutter            — define in/out scope
  ├─→ Constraint Distiller    — identify constraints + acceptance criteria
  ├─→ Requirements Engineer   — RFC 2119 requirements with IDs
  ├─→ Ambiguity Hunter        — flag and resolve ambiguities
  ├─→ Security Engineer       — threat models + abuse cases
  ├─→ Contract Architect      — API design, events, errors
  ├─→ Verification Matrix     — proof paths for every requirement
  ├─→ Batch Planner           — incremental delivery plan
  ├─→ Final Gate              — go/no-go with blocker list
  │
  └─→ Output: production-ready PRD with security built in

The Pipeline Navigator orchestrates the flow, and the Orchestrator coordinates handoffs between roles.

---

Domain Tiers

The CTI search uses a four-tier domain system for intelligent query routing:

Routing Logic

---

NotebookLM Integration

Push CTI research findings directly into Google NotebookLM for citation-backed analysis powered by Gemini.

Setup

1. Install the notebooklm-connector plugin
2. Get your notebook ID from the URL: https://notebooklm.google.com/notebook/
3. Set environment variable: export NOTEBOOKLM_NOTEBOOK_ID=your_id

Usage

/cti-search CVE-2024-21762 --notebooklm

The plugin searches, collects result URLs, pushes them as sources to your notebook, and reports the count.

---

Configuration & Customization

All skills and plugins are designed to be customized for your organization. No internal identifiers, names, or workspace details are hardcoded — you provide your own on first use.

Skill Customization

CTI Search — Customization

Secure PRD — Customization

On first use, Claude will prompt you for:

You can set these persistently via environment variables:

export PRD_OWNER="@your-name"
export PRD_STAKEHOLDERS="@lead1, @lead2"
export PRD_CONFLUENCE_SPACE="ENG"
export PRD_CONFLUENCE_TEMPLATE="PRD Templates"

Or override per request: Write a PRD for X. Owner: @jane. Space: PRODUCT.

---

Required: Search API Key

Environment Variables

Create a .env file in the plugin directory or export system-wide:

# Required
BRAVE_SEARCH_API_KEY=your_brave_api_key_here
SEARCH_PROVIDER=brave

# Optional — NotebookLM
NOTEBOOKLM_NOTEBOOK_ID=your_notebook_id_here

Verify Installation

# What is installed, and from which marketplace
claude plugin list

# What a plugin actually exposes — skills, agents, hooks, projected token cost
claude plugin details phoenix-cti-search

# Test the CTI CLI (dry run, no API call)
CTI=~/.claude/plugins/marketplaces/phoenix-security/plugins/phoenix-cti-search
node "$CTI/index.js" --query "CVE-2024-21762" --dry-run

---

Contributing

We welcome contributions from the global security community. Whether you’re adding a new skill, improving an existing plugin, curating domains, or fixing docs — every contribution matters.

See the Contributing Guide for:

• Step-by-step instructions to add new skills and plugins
• Templates for SKILL.md, README.md, install.sh, and MCP servers
• Documentation standards and testing checklists
• Pull request process and code review expectations

Quick start:

# 1. Fork this repository
# 2. Clone your fork
git clone https://github.com/Security-Phoenix-demo/security-skills-claude-code.git
cd security-skills-claude-code

# 3. Create a feature branch
git checkout -b feature/your-new-skill

# 4. Follow the Contributing Guide
# 5. Submit a pull request

---

Frequently Asked Questions (FAQ)

General

Installation & Setup

CTI Search

OpenGrep / SAST Rules

NotebookLM

Phoenix Pipeline & PRD

Contributing

Security & Privacy

---

Detailed Documentation

---

License

MIT License — see LICENSE for details.

---

Support

• Issues: GitHub Issues — bugs and feature requests
• Discussions: GitHub Discussions — questions and ideas
• Documentation: See the detailed docs table above

---

Security Note

This toolkit is designed for legitimate security research and threat intelligence gathering. Always:

• Respect rate limits and terms of service for search APIs
• Use responsibly and ethically
• Follow responsible disclosure practices
• Comply with applicable laws and regulations in your jurisdiction

---

Acknowledgments

Built and maintained by the engineering and security engineering teams at Phoenix Security for the global security community.

• Open sourced for everyone to use, improve, and extend
• Curated domain list includes 595+ trusted security sources
• Designed for the Claude Code ecosystem and Claude Marketplace
• Inspired by the need for efficient, structured, and repeatable CTI research workflows

Contributors are welcome from anywhere in the world. See CONTRIBUTING.md to get started.

---

Made with purpose by Phoenix Security Security skills for the AI-native developer