Edson

Application Security Manager | CISM, CISSP, CSSLP, CCSP, C|CISO

[Guillermo Casaus @_guillecasaus]

Cloudflare ha liberado su propia skill para hacer auditorías de seguridad con IA.

Es la que utilizan internamente en la empresa para detectar vulnerabilidades y ahora cualquiera puede utilizarla con su agente.

Se llama Security Audit Skill y organiza cada auditoría en 6 fases:

✓ Reconocimiento de la arquitectura y superficies de ataque
✓ Búsqueda de vulnerabilidades por cobertura
✓ Validación independiente de cada hallazgo
✓ Generación de resultados estructurados
✓ Verificación final con agentes distintos
✓ Creación automática del informe de seguridad

Lo más interesante es que el agente que valida una vulnerabilidad nunca es el mismo que la encontró, reduciendo bastante los falsos positivos.

Es completamente gratuita, open-source y tiene licencia MIT.

Repo 👇

[Eduardo Bolsonaro🇧🇷 @BolsonaroSP]

STF acaba de aceitar que o acusado vote, decida se ele próprio será ou não investigado.

A esta porcaria há quem diga ser um tribunal.

[7h3h4ckv157 @7h3h4ckv157]

AI agents that run a penetration test end to end and write the report.

Source/Credit: https://t.co/568hWjrgID

[Nicolas Krassas @Dinosn]

2akouwu/reverify: Anti-hallucination for AI agents that read binaries. The model proposes, deterministic tools decide: every claim is VERIFIED or REFUTED against the real bytes, with evidence, and grounded facts survive context... https://t.co/vYo7TFkG4l

[ɐpnH @AlAssaf_H]

Papers, projects, and agent skills for LLM-based vulnerability detection and discovery.
https://t.co/vSMKLCVH53

[Rıdvan Yağlı @ridvanyagli]

AutoCVE, Yapay zeka ajanlarıyla tek tıkla otomatik CVE keşfi ve kaynak kod güvenlik denetimi yapar.
https://t.co/Q3UrRY11kA

[Ren @Ryrenz]

🕵️ 又发现一个 Claude Code 外挂，做漏洞赏金的人从侦察、测试到写报告，全在终端里跑完

GitHub 上 4.4K stars，MIT 许可证，需要 Python 3.10 以上。

打一个授权目标的老流程是这样的：subfinder 扫子域，httpx 探活，nuclei 跑模板，ffuf 爆目录，katana 爬链接，工具来回切，结果散成一堆文本文件，最后还得自己坐下来手写报告。这个项目把整条流程编排成 33 个斜杠命令和 9 个专用智能体，跨会话记着你上次做到哪一步，Web2 那边覆盖 26 类漏洞，Web3 智能合约 10 类。

除了独立命令行，Claude Code、OpenCode、Pi Agent 和 Codex 都能接进去；模型可以选 Claude、OpenAI、DeepSeek、Groq，也能用 Ollama 在本地跑。仓库自己写明了只能用于获得授权的安全测试，工具是中立的，打谁、有没有拿到授权，是使用者自己的事。

GitHub：https://t.co/G5HO3Q4rjE

[Nix0n @UnTalNixon_exe]

TU AGENTE DE CÓDIGO AHORA DIBUJA ARQUITECTURAS DE VERDAD

Archify es un skill open source que convierte una descripción o un repositorio en un diagrama de arquitectura interactivo.

No es Mermaid.
No es un screenshot feo de Excalidraw.

Es un HTML auto-contenido con:
→ Diagramas de arquitectura, workflow, sequence, data-flow y lifecycle
→ Motion y trazado de rutas
→ Búsqueda y focus de nodos
→ Export PNG / SVG / WebM
→ Cards listas para compartir (1200×630)

Lo más importante:
Todo está validado.
No inventa conexiones.
Usa un JSON IR tipado + checks atómicos.

Funciona con Cursor, Claude Code, Codex y OpenCode.

16k estrellas.

Guárdalo. Es de los skills más útiles que han salido este año.

Repoo 👇👇

[Het Mehta @hetmehtaa]

Xalgorix: Open-source AI pentester that proves vulnerabilities

[Nitin Gavhane @NitinGavhane_]

https://t.co/exPDzS2mPK

[Abhishek @aacle_]

I Connected Claude Code direct to Burp via MCP

one command:

```
claude mcp add burp --transport sse http://127.0.0.1:9876
```

that's literally it.

after that Claude start working by himself:

- browse my proxy history
- do auto-recon on target
- create testing todo-list
- play with requests and responses
- find bugs while i do other stuff

i just give him scope. he do the grinding. i do the thinking.

result so far: **11 confirmed bugs**

real bugs. not hallucination. i verified each one.

https://t.co/4ritanX0F4

[Tom Dörr @tom_doerr]

LLMRouter uses over 16 router models to dynamically route queries to the optimal LLM based on complexity, cost, and performance requirements.

https://t.co/WZc1TbUxsJ

[Ihtesham Ali @ihteshamali]

A two-person security team used AI to find real vulnerabilities in code and earned $250,000 from a single bounty.

Now they have open-sourced the system behind it.

It is called Open-Kritt.

Most people scan a repository by giving an AI one giant task:

“Find every vulnerability in this code.”

Open-Kritt takes a more focused approach.

First, one agent maps every reachable entry point.

Then it launches separate agents to trace each code path and search for specific failures.

Each agent gets its own isolated container, where it can:

> Inspect the code
> Install security tools
> Compile the project
> Run tests
> Fuzz inputs
> Build a proof of concept

The raw findings are then checked, merged when they describe the same bug, and ranked so researchers can inspect the most promising ones first.

It works with Codex, Claude Code, OpenAI, Anthropic, and OpenRouter.

The Kritt team says it used the system to find more than 20 High and Critical vulnerabilities in nine months.

It also finished first in the Firedancer V1 audit competition using fully AI-driven research with no manual review.

This is an open-source research lab that turns AI agents into a small security team.

https://t.co/SbjO3mBhm7

[7h3h4ckv157 @7h3h4ckv157]

Agentic offensive-security in your terminal

Credit/Source: https://t.co/ozndJeiCVL

[AM09:21 @AM09_21]

あっー！ 神神神神神神
Qwen 3あたりで知識止まってたので本当にありがとう！！
マジで！！！ありがとうすぎる！！！！！！

みんなも、読めよな

[Guillermo Casaus @_guillecasaus]

Si te dedicas a la ciberseguridad, esto te interesa.

Existe un repositorio con más de 800 skills para agentes de IA capaces de realizar tareas avanzadas de ciberseguridad.

→ Threat Hunting y respuesta a incidentes
→ Análisis forense y malware
→ Red Teaming y Cloud Security
→ Compatible con Claude Code, Cursor, Codex y otros agentes

Ya supera las 26.200 estrellas en GitHub y es completamente open-source.

Enlace 👇