{
  "markdown": "# Cyber Punk (Security Vulnerability Scanner)\n\nA Claude Code plugin that automates security vulnerability analysis for any project.\n\n## Example Use Cases\n\n- **Pre-deploy audit**: Run a full scan before shipping to production to catch SQL injections, XSS, hardcoded secrets, and misconfigurations\n- **Dependency check**: Discover which of your npm/pip/cargo packages have known CVEs and what versions fix them\n- **Code review security pass**: Scan a PR branch for insecure patterns — command injection, path traversal, weak crypto — before merging\n- **Legacy codebase hardening**: Point it at an inherited project to get a prioritized list of vulnerabilities with root cause analysis\n- **Compliance preparation**: Generate a detailed security report (with WHY/HOW/WHAT analysis) for GDPR, PCI-DSS, or SOC 2 audits\n- **Security training**: Use the generated PoC scripts (with `--dry-run`) to understand how real exploits work on your own code\n- **CI/CD pipeline gate**: Integrate the scan into your workflow to block deploys when critical vulnerabilities are found\n\n## What it does\n\n1. **Detects** your project's tech stack, languages, and dependencies\n2. **Fetches** known CVE/CWE data from the NIST National Vulnerability Database\n3. **Scans** your code for vulnerable patterns using 576 regex rules across 20 CWEs\n4. **Generates** proof-of-concept exploit scripts for confirmed vulnerabilities\n5. **Reports** a detailed security analysis with root cause, attack vector, and impact for each finding\n\n## Supported Languages\n\nJavaScript/TypeScript, Python, Go, Java, Rust, PHP, Ruby, C/C++\n\n## Prerequisites\n\n- Python 3.8+\n- `requests` library: `pip install requests`\n- NVD API key (optional, recommended): [Request one here](https://nvd.nist.gov/developers/request-an-api-key)\n\nSet your API key:\n```bash\nexport NVD_API_KEY=\"your-key-here\"\n```\n\n## Installation\n\n```bash\nclaude plugin install cyber-punk\n```\n\nOr test locally:\n```bash\nclaude --plugin-dir /path/to/SkillCyberPunk\n```\n\n## Usage\n\nInvoke the skill in any project:\n\n```\n/cyber-punk\n```\n\nOr ask naturally:\n\n```\n\"Scan this project for security vulnerabilities\"\n\"Check for CVEs in my dependencies\"\n\"Run a security audit\"\n\"Find insecure code patterns\"\n```\n\n## Output\n\n- `security-report-YYYY-MM-DD.md` — Full vulnerability report with WHY/HOW/WHAT analysis, severity scores, and fix recommendations\n- `security-pocs/` — Proof-of-concept exploit scripts (with `--dry-run` safety mode)\n\n## CWE Coverage\n\n| Category | CWEs |\n|----------|------|\n| Injection | CWE-89 (SQL), CWE-78 (OS Command), CWE-79 (XSS) |\n| Traversal & SSRF | CWE-22 (Path Traversal), CWE-918 (SSRF) |\n| Auth & Access | CWE-287, CWE-306, CWE-862 |\n| Data Exposure | CWE-200, CWE-798 (Hardcoded Creds) |\n| Deserialization | CWE-502 |\n| Crypto | CWE-327 (Weak Crypto) |\n| Web | CWE-352 (CSRF), CWE-434 (File Upload), CWE-611 (XXE) |\n| Memory Safety | CWE-119 (Buffer Overflow), CWE-416 (Use After Free), CWE-190 (Integer Overflow) |\n| Config | CWE-732 (Permissions), CWE-400 (Resource Consumption) |\n\n## License\n\nMIT\n",
  "bytes": 3036,
  "sha": "ed4c9ea613ad896f29a7701859ce2fb39d5b4baeb470630cba651d8adce24817",
  "repo_slug": "bonciarello/cyber-punk",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_bonciarello_cyber_punk_cyber_punk_add0a2ba/readme"
}