Aegis — Security Skills For AI Engineers

Production-grade red-team security auditing for Claude Code, Cursor, Antigravity, Windsurf, Codex, and Copilot — real vulnerability hunting, not superficial advice.

Developing production applications is hard. Most AI coding assistants give generic security recommendations like "use HTTPS" or "sanitize user inputs". They don't actually inspect your middleware, trace JWT lifecycles, test multi-tenant IDOR boundaries, or audit database RLS policies.

Aegis turns your AI assistant into a ruthless senior red-team security engineer that deep-inspects your repository, greps for hidden bypass tokens, runs red-team simulations, and provides drop-in production code fixes.

---

Quickstart (30-second setup)

1. Install via skills.sh (Recommended)

Run the universal installer in your project terminal:

npx skills@latest add erkan3034/aegis

Pick the aegis skill and select your target AI coding agents.

2. Install as a Claude Code Plugin

Inside Claude Code:

/plugin marketplace add erkan3034/aegis
/plugin install aegis@erkan3034

Or from your shell:

claude plugin marketplace add erkan3034/aegis
claude plugin install aegis@erkan3034

3. Manual Installation (Cursor / Antigravity)

• Cursor MDC Rule: Download integrations/cursor/aegis.mdc to .cursor/rules/aegis.mdc.
• Antigravity / Standard Agent Skill: Download skills/aegis/SKILL.md to .agents/skills/aegis/SKILL.md.

---

Why Aegis Exists

I built Aegis to fix common security failure modes when building software with AI coding agents.

Problem #1: AI Assistants Give Surface-Level Security Advice

"Do not assume the code is secure. Act like a real red-team security engineer trying to break the system."

The Problem: Default AI models are polite. When you ask "Is this secure?", they look at a 20-line snippet, say "Looks good!", and ignore the missing server-side authorization check in the API route.

The Fix: Aegis enforces a mandatory 8-Phase Audit Workflow. It forces the AI to trace data flow through components -> context -> API client -> route handler -> database query before rendering a verdict.

Problem #2: Hidden Dev Tokens & Auth Bypasses

The Problem: During fast prototyping, devs leave "dev-token", mock auth handlers, commented security checks, or hardcoded secrets in middleware. These quietly ship to production.

The Fix: Aegis executes mandatory automated grep search patterns across the entire codebase to detect:

• "dev-token", "mock", "bypass", "skipAuth"
• Hardcoded API keys, JWT secrets, and exposed Supabase service_role keys
• Commented security guards (// TODO: add auth check)

Problem #3: Vulnerability Lists Without Production Fixes

The Problem: Traditional scanners output vague vulnerability descriptions that leave you searching StackOverflow for hours.

The Fix: Aegis requires every finding to include Production-Grade Secure Replacement Code — complete drop-in fixes ready to be applied directly into your repository.

---

Multi-Agent Compatibility Matrix

AI Assistant	Format	Installation Path
Antigravity / Gemini Agent	Agent Skill (SKILL.md)	.agents/skills/aegis/
Cursor	MDC Rule (.mdc)	.cursor/rules/aegis.mdc
Claude Code	Agent Skill / Plugin	CLAUDE.md / Plugin Marketplace
Windsurf	.windsurfrules	.windsurfrules
OpenAI Codex / ChatGPT	System Prompt	Custom Instructions
Roo Code / Cline	Custom Mode	.clinerules

---

How to Run Aegis

Once installed, prompt your AI assistant:

/aegis

or

Run an Aegis 8-phase red-team security audit on this repository and provide production fixes.

---

8-Phase Security Audit Workflow

1. Architecture & Attack Surface Mapping — Trust boundary mapping.
2. Authentication Security Audit — JWT validation, token storage (HttpOnly vs localStorage), cookie flags, SSR sync.
3. Authorization & Multi-Tenant Isolation — RBAC, ABAC, IDOR vectors, vertical/horizontal privilege escalation.
4. Frontend Security Audit — Client bundle exposures, XSS vectors, unsafe HTML rendering.
5. Backend & API Security Audit — Server-side ownership validation, rate limiting, file upload path traversal.
6. Infrastructure & Hardening Audit — CSP, CORS, HSTS, security headers, env secrets.
7. Dependency & Supply Chain Audit — Package manifest CVE check & supply chain risks.
8. Red Team Attack Simulation — Token forgery, cross-tenant access simulation.

---

Standardized 12-Section Output Report

Every audit generates a structured 12-part report:

1. Executive Security Summary
2. Critical Findings Summary
3. Full Vulnerability Table (CVSS Ratings)
4. Attack Surface Map
5. Production Readiness Score (/10)
6. Detailed Findings & Proof-of-Concepts (PoCs)
7. Immediate Critical Fixes Checklist
8. Recommended Security Architecture Improvements
9. Secure Refactor Code Suggestions (Drop-In Fixes)
10. Security Hardening Checklist
11. OWASP Top 10 Mapping Table
12. Final Security Verdict

👉 See full sample audit output in examples/SAMPLE_SECURITY_REPORT.md.

---

Search & Discovery Keywords

agent-skill • security-skill • ai-security-auditor • claude-code-security-skill • cursor-rules-security • windsurf-rules-security • red-team-ai-skill • owasp-top-10-scanner • vulnerability-scanner-prompt • penetration-testing-skill • antigravity-skill • code-security-audit • zero-trust-security

---

License

Distributed under the MIT License.