vantagelisted

Autonomous, artifact-driven SAST (Static Application Security Testing) for web AND mobile app repositories, plus optional code-level remediation. Use whenever the user asks to security-review, pentest, audit, or scan a codebase for vulnerabilities — web (SQLi, XSS, IDOR/BOLA, auth bypass, SSRF, XXE, hardcoded secrets, vulnerable dependencies, business logic flaws) or mobile/Android/iOS (OWASP Mobile Top 10 2024: improper credential usage, insecure data storage, insecure communication, insufficient cryptography, etc.) — via static code analysis, never by running the app, installing it, or sending requests. Also use when the user asks to fix, patch, or remediate a finding this framework produced, or to check a single commit/PR/MR for newly introduced vulnerabilities without a full repo scan. Drives a 6-phase scan pipeline (recon, mapping, testing, validation, PoC, reporting) through the vantage plugin's specialized subagents, branching on platform, plus a separate on-demand fix step and a fast incremental commi
tinoimammp/vantage-security-agent · ★ 4 · Data & Documents · score 77

Install: claude install-skill tinoimammp/vantage-security-agent

# Pentest SAST — Orchestration Skill This skill is the entry point for the `vantage` plugin. It covers **both** the web and mobile **scan** pipelines, and the separate **fix** capability. It is intentionally short: everything phase-specific lives in `${CLAUDE_PLUGIN_ROOT}/agents/{web,mobile,others}/*.md`, read on demand. Cross-phase control (gates, parallelism, resume) lives in `${CLAUDE_PLUGIN_ROOT}/workflow/orchestration.md`. ## Two roots — do not confuse them - **Plugin assets** (`workflow/`, `agents/`, `schemas/`, `templates/`, `knowledge/`, `examples/`, `START-HERE.md`, `TIMESTAMPS.md`) live at `${CLAUDE_PLUGIN_ROOT}` — always resolve them from there, never from the target project's working directory. - **Artifacts** (scope, endpoints, findings, PoCs, reports, fixes) are per-engagement output, always written under `./.vantage/artifacts/...` **relative to the target project currently open** — never inside the plugin's own install directory. ## Golden rules (non-negotiable) 1. **SAST only during scanning.** Analyze source code, configuration, and dependencies. Never run the application, never install a mobile build, never send requests, never exploit live systems. (Live verification of a PoC is a separate, human-run manual step.) 2. **One exception: `fix-agent`.** Every scan-phase agent is strictly read-only. `fix-agent` — invoked only by `/vantage:fix-issue`, `/vantage:fix`, or `/vantage:fix-diff`, never automatically — is the sole agent