Claude Cyber turns Claude into a full-spectrum InfoSec professional — offensive, application security, defensive and governance. Not a prompt pack: an ethical, grounded expert that refuses unauthorized work, cites real data instead of guessing, and can teach any concept from the basics.
claude plugin marketplace add unicorn-rm/Claude-cyberclaude plugin install security@claude-cyber
Every skill is built on the same spine — it won’t act without authorization, won’t invent a fact, and won’t leave you behind.
Before any active offensive step it demands a defined engagement scope. Out-of-scope or unauthorized targets are refused — and it never records authorization you don’t hold.
Every CVE, CVSS, EPSS, CISA KEV, MITRE ATT&CK, CWE and OWASP reference is pulled from authoritative sources, with live-lookup recipes for NVD, EPSS and KEV. It won’t invent a CVE or a score.
Senior depth, but it explains any concept from first principles with plain analogies. Ask it to go deeper or start over — a tool and a companion that meets you at your level.
Authorization and grounding wrap everything; methodology, agents and commands sit on top. Every skill follows the same seven-beat contract.
The mascot appears in role variants — each colour is a security discipline, and each maps 1:1 to an agent you can call by name.
Runs authorized offensive engagements end to end. Maps the external and internal attack surface, finds and safely confirms in-scope vulnerabilities, chains them into real impact, and writes each one up on the canonical finding schema — always inside the agreed scope.
Defends and investigates. Writes and tunes detections, runs the incident-response lifecycle, does disk and memory forensics, hunts for threats that slipped past tooling, analyzes malware safely, and hardens systems to a baseline — turning findings into durable detections.
Secures the code before it ships. Reviews source and pull requests by tracing untrusted input to dangerous sinks, triages SAST/DAST output down to confirmed issues, audits dependencies and crypto usage, and proposes concrete secure fixes.
Designs security in, before code exists. Builds data-flow diagrams with trust boundaries, enumerates threats with STRIDE and attack trees, rates them, and hands back a prioritized list of mitigations mapped to requirements and tests.
Turns a noisy pile of findings into a queue you can act on. Deduplicates and confirms, scores technical severity with CVSS, weights real-world risk with EPSS and CISA KEV plus business context, and assigns a risk-based SLA to each.
Produces the deliverable a client actually reads. An executive summary in business language, technical findings on the canonical schema with evidence and remediation, a prioritized roadmap, retest results, and mapping to compliance controls.
Two backbone skills underlie everything; the rest cover the full lifecycle — offense, application security, defense and governance.
authorization-gate — scope & refusalintel-sources — grounding, live lookups, finding schemaClaude auto-loads the right skill when your request matches — “explain SQL injection” pulls web-exploitation; any CVE mention pulls intel-sources.
You type /security:… for deliberate workflows and side-effect actions — /security:engagement writes the scope record.
Claude delegates to a persona automatically, or you name it — “use the pentester agent.”
A disciplined spec → plan → build, gated by tests that must stay green on every change.
A brainstorm became a written spec, then a phased implementation plan, then the build — with review checkpoints at every phase.
A dependency-free validate_plugin.py keeps every skill consistent — manifest, frontmatter, required references, mandatory gate + grounding markers, hooks and evals. Green on every change.
plugin eval suiteFive cases regression-test the flagship behavior: gate refusal, no-fabrication grounding, teaching-from-basics, KEV-aware triage, full CVSS vectors.
A hook logs executed shell commands to .security/audit.log (UTC + command) for the engagement report.
Offensive methodology is adapted from the open-source Claude-Red project (MIT, © 2024–2025 SnailSploit / Kai Aizen), rewritten to Claude Cyber’s gate + grounding + finding schema. See NOTICE.md.
Skills, agents and commands are Markdown + YAML; manifests JSON; the validator Python; the hook shell. Shipped after a full end-to-end engagement test — recon → triage → report.
claude plugin marketplace add unicorn-rm/Claude-cyberclaude plugin install security@claude-cyberthen start a new Claude Code session — plugins load at startFor pentests with a signed scope, bug bounty within program rules, systems you own, labs, CTFs and research. The authorization-gate refuses unauthorized or out-of-scope targets and never fabricates authorization. Not legal advice.