Skip to content
Agentmart
Submit a tool

appsec-security-orchestrator

Application Security (AppSec) orchestrator for commercial web and server projects.

Skill by SensLiao

IndexedLicense unknown
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/sensliao-appsec-security-orchestrator

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Application Security (AppSec) orchestrator for commercial web and server projects. Activate as soon as a project has backend / API / auth / user-data / file-upload / payment / admin / multi-tenant / GenAI-agent surface, or nears production — including when the ask names only one endpoint or one auth file. Small scope does not waive this route: a review done inline leaves no evidence trail, no ASVS / CSF mapping and no remediation routing. Maps NIST CSF 2.0 over a 6-layer capability map. Use for threat modeling, supply-chain / SCA / secret / SAST scanning, auth and input-validation and API security review, OWASP ASVS 5.0 / WSTG / API Top 10 mapping, headers and session review, remediation routing, DAST baseline planning. Casual triggers: "security review / is this secure / make sure it's secure / check for vulnerabilities / before we deploy / review the login API and auth handling / 安全审查 / 上线前检查". Performs no active scans — active validation is gated by `authorized-pentest-validation`.

Use cases: backend, devops, data, security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found
Runs as
Node.js package

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/appsec-security-orchestrator

Tools it pre-approves 6

From allowed-tools in SKILL.md: the agent may use these without asking you each time.

  • Read,
  • Write,
  • Edit,
  • Bash,
  • Grep,
  • Glob

What's inside

Skill name
appsec-security-orchestrator
Description
Application Security (AppSec) orchestrator for commercial web and server projects. Activate as soon as a project has backend / API / auth / user-data / file-upload / payment / admin / multi-tenant / GenAI-agent surface, or nears production — including when the ask names only one endpoint or one auth file. Small scope does not waive this route: a review done inline leaves no evidence trail, no ASVS / CSF mapping and no remediation routing. Maps NIST CSF 2.0 over a 6-layer capability map. Use for threat modeling, supply-chain / SCA / secret / SAST scanning, auth and input-validation and API security review, OWASP ASVS 5.0 / WSTG / API Top 10 mapping, headers and session review, remediation routing, DAST baseline planning. Casual triggers: "security review / is this secure / make sure it's secure / check for vulnerabilities / before we deploy / review the login API and auth handling / 安全审查 / 上线前检查". Performs no active scans — active validation is gated by `authorized-pentest-validation`.
License
unknown
Allowed tools
Read,, Write,, Edit,, Bash,, Grep,, Glob
Instructions
1,173 lines in SKILL.md · view on GitHub

Before installing

  • Ships executable scripts
  • Pre-approves some shell commands
  • Instructions read files in your home folder (~/.ssh, ~/.aws…)

Agent Skills spec issues

  • body: 1173 lines (spec recommends under 500)

Files (34)

  • SKILL.md
  • MANIFEST.md · references/
  • README.md · references/
  • crosswalk.schema.json · references/
  • deprecated-v2.md · references/
  • external-links.md · references/
  • risks.md · references/
  • standards-and-mappings.md · references/
  • standards-crosswalk.json · references/
  • test-plan.md · references/
  • validate-crosswalk.js · references/
  • workflow-spec-dispatch.md · references/
  • asset-inventory.schema.yaml · templates/
  • attack-coverage-template.yaml · templates/
  • authz-matrix.schema.yaml · templates/
  • control-matrix.template.yaml · templates/
  • data-classification.schema.yaml · templates/
  • README.md · templates/dot-appsec-skeleton/
  • appsec_release_decision.yaml.tmpl · templates/dot-appsec-skeleton/
  • config.json.tmpl · templates/dot-appsec-skeleton/
  • finding.yaml.tmpl · templates/dot-appsec-skeleton/
  • hook-fixture-harness.sh · templates/dot-appsec-skeleton/
  • risk-acceptance.yaml.tmpl · templates/dot-appsec-skeleton/
  • settings.json.snippet · templates/dot-appsec-skeleton/
  • state.json.tmpl · templates/dot-appsec-skeleton/
  • incident-response-initial.md · templates/
  • overlay-checklist.template.yaml · templates/
  • pentest-report.template.md · templates/
  • risk-register.md · templates/
  • security-policy.template.yaml · templates/
  • security-test-plan.md · templates/
  • threat-model-STRIDE.md · templates/
  • threat-model.schema.json · templates/
  • vuln-report.md · templates/

The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub

More from SensLiao/Claude-code-setting

Signals

Stars
0
Forks
0
Open issues
0
Last commit (this folder)
Aug 3, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License
License unknown
Repository
github.com/SensLiao/Claude-code-setting
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

More from SensLiao

Cite this page

appsec-security-orchestrator skill. Agent Mart. https://agentmart.dev/skills/sensliao-appsec-security-orchestrator (last updated 2026-10-24)