Security

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons.

Django access control and IDOR security review.

GitHub Actions security review for workflow exploitation vulnerabilities.

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump…

Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable…

Security code review for vulnerabilities.

Scan agent skills for security issues.

Run evaluations on Agent Skills to measure their effectiveness.

Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a codebase, drawing on twelve classic…

Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly…

Audit or rewrite AGENTS.md so it holds only lasting principles.

Audit and prioritize performance work through bounded-work and forward-progress checks.

Audit whether tests earn their maintenance cost and which suite owns each contract.

Review changed code for naming, stale references, unnecessary complexity, and comment quality.

Break large features into independently verifiable, human-reviewable slices under a feature directory in specs/.

Add GitHub skill repos to the ASM index: clone, audit, eval, regenerate index, rebuild catalog, open PR.

Analyzes code files and reports statistics including line counts, file counts by extension, and total size.

ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup…

Perform Porter's Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants.

Draft a detailed privacy policy covering data types, jurisdiction, GDPR and compliance considerations, and clauses needing legal review.

The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping.

Formats text according to specified style guidelines.

Maintenance orchestrator for the brooks-lint plugin itself.

Maintenance orchestrator for the brooks-lint plugin itself.