security-research
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.
Profile →npx skills add code-yeongyu/oh-my-openagent --skill security-research --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Research - Team Mode Vulnerability Audit Use this skill to run a parallel security audit that separates real exploitability from generic concern. The team has 3 vulnerability hunters and 2 PoC engineers. ## Hard Preconditions Before starting, verify: 1. `team_*` tools are available. If not, stop and tell the user: `security-research requires team-mode. Set team_mode.enabled: true in your oh-my-openagent config, restart opencode, then retry.` 2. You are in the main session, not a background subagent. 3. You have a concrete target: repository, diff range, PR, release candidate, path list, or threat surface. If the user provided no target, audit the current repository and current branch diff against its upstream or merge base. If there is no diff, audit the security-sensitive surfaces in the working tree. ## Severity Standard Use these references as the scoring frame: - CWE for root-cause weakness classification: https://cwe.mitre.org/ - OWASP WSTG for test methodology: https://devguide.owasp.org/en/06-verification/01-guides/01-wstg/ - OWASP ASVS for control verification: https://owasp.org/www-project-application-security-verification-standard/ - CVSS v4.0 for exploitabilit
- Hard Preconditions
- Severity Standard
- Team Roster
- Workflow
- Phase 0: Scope and Baseline
- Phase 1: Independent Hunter Pass
- Phase 2: PoC Pass
- Phase 3: Cross-Check
- Phase 4: Final Report
- Output Rules
What does the security-research skill do?
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.
How do I install it?
Run `npx skills add code-yeongyu/oh-my-openagent --skill security-research --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From code-yeongyu/oh-my-openagent, a repository with 67,209 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.