Security Research
Coordinates parallel vulnerability hunters and PoC engineers to audit a codebase.
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 11, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 5a61c6e
The skill's own Hard Preconditions require `team_*` Team Mode tools from oh-my-openagent/opencode's multi-agent config, which are absent in standard Claude Code, so the advertised 3-hunter/2-PoC parallel workflow cannot run as designed and the skill's correct behavior would be to halt; it was tested here via a single-agent adaptation that ran the phases sequentially. Verbatim clone+copy installs cleanly (single SKILL.md, strict-YAML frontmatter parses, no missing referenced files). In an A/B on a defensive audit of a toy Express file, the skill-armed run and the base run were indistinguishable — both reached verdict BLOCK and found the same three vulnerabilities (SQLi CWE-89, path traversal CWE-22, OS command injection CWE-78) with equivalent CWE/line/fix detail and safe local PoCs, so the parallel-falsification value the skill is built around never materialized outside its native host.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 4/5
- Output vs. baseline 5/10
- Docs & honesty 2/5
What Security Research does
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers:…
How to install Security Research
git clone https://github.com/code-yeongyu/oh-my-openagent
cd oh-my-openagent
mkdir -p ~/.claude/skills
cp -r .agents/skills/security-research ~/.claude/skills/security-research
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Security Research
-
/security-researchCoordinates parallel vulnerability hunters and PoC engineers to audit a codebase.
It also activates on plain-language prompts like these:
-
Run a security review of this codebase before release -
Hunt for vulnerabilities and prove exploitability -
Do a pre-release security audit with severity ratings
Frequently asked questions
- Is the Security Research skill free?
- Yes. The skill itself is free from code-yeongyu/oh-my-openagent. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Security Research work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 11, 2026. Verdict: Works with setup. The skill's own Hard Preconditions require `team_*` Team Mode tools from oh-my-openagent/opencode's multi-agent config, which are absent in standard Claude Code, so the advertised 3-hunter/2-PoC parallel workflow cannot run as designed and the skill's correct behavior would be to halt; it was tested here via a single-agent adaptation that ran the phases sequentially. Verbatim clone+copy installs cleanly (single SKILL.md, strict-YAML frontmatter parses, no missing referenced files). In an A/B on a defensive audit of a toy Express file, the skill-armed run and the base run were indistinguishable — both reached verdict BLOCK and found the same three vulnerabilities (SQLi CWE-89, path traversal CWE-22, OS command injection CWE-78) with equivalent CWE/line/fix detail and safe local PoCs, so the parallel-falsification value the skill is built around never materialized outside its native host.
- What is the Security Research SkillProof Score?
- 6.4/10 — installs cleanly 5/5, triggers reliably 4/5, output vs. baseline 5/10, docs & honesty 2/5.
- How do I install Security Research?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Security Research with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.