CVE-2026-103012

The Claude Code application is vulnerable to a security flaw where it prioritizes locally stored API keys (from previous logins or configurations) over the server-managed settings of a valid Claude Enterprise or Team account. If the settings endpoint rejects the stored key, the session may start ...

PT-2026-103121

Name of the Vulnerable Software and Affected Versions Claude Code versions 2.0.68 through 2.1.259 Description Claude Code prioritized a locally stored API key, such as one from a previous /login or configuration file, over a valid Claude Enterprise or Team sign-in when retrieving server-managed...

aigate

aigate Гигиена секретов для кода, сгенерированного ИИ. Выявляет захардкоженные учётные данные в промптах, входных данных инструментов, сгенерированном коде и существующих файлах. Быстрый старт pip install aigate && aigate setup-all Вот и всё. Это устанавливает фоновый прокси режим редактирования,...

security-harness

Security Harness Claude Code그리고 추후 다른 AI 에이전트를 위한 멀티 에이전트 애플리케이션 보안 검토 하네스 입니다. 하나의 라우터 스킬이 코드베이스를 매핑 하고, 클래스별 지식 베이스로 취약점을 사냥 하며, 발견 사항을 연쇄시켜 에스컬레이션으로 연결 하고, 실제 영향을 검증 한 뒤, README / JSON / SARIF / doc / PDF로 보고 하는 완전한 공격 보안 파이프라인으로 디스패치합니다. 범위: 이 하네스는 자신이 소유하거나 테스트 권한이 있는 코드에 대해 정적 분석소스 검토, 데이터 ...

firmware-reverse-engineering

펌웨어 리버스 엔지니어링 스킬 OrbitCurve의 펌웨어 추출, 정적 분석, Ghidra 리버스 엔지니어링, 에뮬레이션 및 보안 보고를 위한 5가지 에이전트 스킬로, Hussein Muhaisen이 작성했습니다. 이 컬렉션은 Claude Code 및 Codex용 기존 워크플로우, 참조 자료, 템플릿 및 Ghidra 스크립트를 패키징합니다. 설치하면 에이전트가 지침을 사용할 수 있게 되며, 분석 도구는 별도로 설치해야 합니다. 검증: Claude Code 및 Codex 패키징/검색 확인, Ghidra 스크립트 회귀 테스트, 선...

shai-hulud-scan

shai-hulud-scan Навык Claude Code, который сканирует машины на наличие индикаторов компрометации IOC от червя цепочки поставок Mini Shai-Hulud CVE-2026-45321, CVSS 9.6. Что такое Mini Shai-Hulud? Самовоспроизводящийся червь цепочки поставок, скомпрометировавший более 170 npm/PyPI пакетов 11 мая...

ai-tool-poisoning-guard

ai-tool-poisoning-guard Minimum security-baseline rule for Claude Code, Codex, and Cursor. This free rule closes a real gap in each tool's built-in review. Full ruleset + implementation guide: Gumroad link — coming soon. Your AI coding assistant reviews code. It doesn't review the sentence that...

Agentic-Bug-Hunter

AI-powered bug bounty hunting — recon to report, in your terminal. What Is This · Trusted By · Free Setup · Quick Start · Commands · What It Finds · AXguard · Support · FAQ Built and maintained by AwareXone · Website · X · GitHub !SocialSafe by AwareXone provides case review and assistance for...

CVE-2025-59536

CVE-2025-59536 - 시작 신뢰 대화 상자 구현. Claude 취약점 심각도: 높음 CVSS: 8.8 영향: 기밀성, 무결성, 가용성 게시일: 2025-10-03 법적 고지 승인된 보안 테스트 전용입니다. 근본 원인 짧은 버전 Claude Code는 에이전트 코딩 도구입니다. 1.0.111 이전 버전은 시작 신뢰 대화 상자 구현의 버그로 인해 코드 주입Code Injection에 취약했습니다. 사용자가 시작 신뢰 대화 상자를 수락하기 전에 Claude Code가 프로젝트에 포함된 코드를 실행하도록 속일 수 있었습니다....

claude-code-security-audit

Claude Code Security Audit & CVE-2026-21852 Scanner A security audit and environment hardening tool for Anthropic's Claude Code agentic CLI. Scans repositories for CVE-2026-21852 pre-trust execution surfaces, hook hijacking, malicious base URL redirection, and unauthenticated token exfiltration...

claude-project-scanner

Claude 프로젝트 스캐너 타사 프로젝트를 열기 전에 알려진 보안 위험을 스캔하는 읽기 전용 Claude Code 스킬입니다. 다음에 문서화된 공격 패턴을 탐지합니다: CVE-2025-59536 Claude Code Lifecycle Hooks 주입 CVE-2025-61260 OpenAI Codex CODEXHOME 주입 CVE-2025-54136 Cursor 플러그인 검증 우회 또한 statusLine.command 실행, additionalDirectories 이스케이프,...

yolo-cage

yolo-cage: автономные агенты кодирования, которые не причиняют вреда Вы ответственный инженер. Вы бы ни за что не позволили ИИ безнаказанно хозяйничать в ваших самых чувствительных системах и кодовых базах. Именно поэтому вы никогда не отключаете защиту для такого инструмента, как Claude Code. Он...

cve-2026-54316-lab

CVE-2026-54316 — Лаборатория эксфильтрации HuggingFace через WebFetch в Claude Code Полноценная одноразовая лаборатория, воспроизводящая GHSA-fg94-h982-f3mm / CVE-2026-54316: Claude Code предварительно одобрил huggingface.co как голое имя хоста для инструмента WebFetch, поэтому любой путь на этом...

red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

kunglao-agent

kunglao-agent kunglao-agent is an autonomous reverse-engineering system. You hand it a target and the questions you need answered; it works the problem for hours or days on its own — planning its own path, recovering from worker deaths, resuming after crashes — and converges only when every answe...

CVE-2026-100585

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

EUVD-2026-87466

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

CVE-2026-100585

The OpenClaw npm package (openclaw) versions prior to 2026.7.1 contains an authorization bypass vulnerability. The software fails to enforce an owner-only requirement for Claude Code permission prompts sent via the MCP channel bridge . This allows an authorized non-owner channel sender with comma...

CVE-2026-100585 OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

CVE-2026-100585 OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...