Skills for AI agents · Claude · Codex · Antigravity · Apache-2.0

An audit is worth as much as its honesty.

Two skills for your AI agent that assess the security and privacy of a web application, prove what they claim and write down, in plain words, what they could not verify.

ExaminedProvenUnknown

Install the skills See a real case

Version 1.4.2 · by Samuele Cucurnia and Pietro Previtali · not a substitute for a penetration tester, a DPO or a lawyer. Commands and reports work in English and Italian.

example session · quick mode

you /appsec-sentinel quick ./my-app

agent Before touching the code: is the repository yours? Static analysis only?

you Yes, mine. Static only.

agent Rules of engagement written. Secret values will not end up in the report.

✓ 7 findings, all "confirmed from code"

! 0 reproduced: no dynamic testing authorized

! Coverage: 14 routes read out of 309

agent Open question: are these routes in the production build?

Apache-2.0Free, including for professional use

Standard library onlyPython; PDFs use reportlab

169 automated checkson fake apps and pages with known flaws

Never "compliant"nor "secure": four declared states

Why they exist

A typical report says "all good". This one says how much it looked at.

Whoever sets budget and priorities trusts what the report says was tested. Claiming a test that never ran is worse than not testing.

A typical report

With sentinel

"No critical vulnerability found"

"14 routes read out of 309: over 280 remain unknown"

The scanner says "critical", so it is critical

Hypothesis to validate, provisional severity, reachability to be checked

Tests described but never run

"Prepared, not executed": a written command is not a passed test

"The application is GDPR compliant"

Four states, never "compliant", questions ready for the DPO and counsel

Secrets and personal data in the attachments

Only location, type and shape; a redaction check before delivery

The two skills

Security and privacy, one method

Each works on its own. Together they share the audit folder and produce a single PDF report.

Security

appsec-sentinel

Application and cloud security assessment: code, configuration, APIs, infrastructure, supply chain.

Authorization gate before any active test
Findings with a state: reproduced, confirmed from code, hypothesis, not verifiable
Coverage with real denominators: files, endpoints, controls
Documentary audit: what the documents say versus what the code does

Repository Command card

Privacy

gdpr-sentinel

Technical and documentary GDPR/ePrivacy review of the processing the system really performs.

Map of the real processing and the A–N controls matrix
Privacy notice versus code, cookies, suppliers, retention, rights
Never says "compliant": four states and ready-made questions
Questions for the controller, DPO, counsel and suppliers, with the material needed

Repository Command card

From security to privacy and back: privacy <repo> and security <repo> hand the work to the sister skill.

Who they are for

IT and NIS2 consultants

A quick first pass and a presentable report, with limits written down and an indicative mapping to the Art. 21 measures.

Public bodies and associations

Anyone running a web management system who needs to see what the privacy notice says against what the software does.

Developers and small teams

A security review of your own app before release, with reproducible findings and a retest plan.

The method

Authorization first, then the work

No active test starts without a scope and written confirmation. Which phases run depends on the mode: quick, standard or full.

Intake and authorization gateOwnership, authorized environments, permitted tests, limits and the person responsible for the kill switch. Without confirmation: local analysis only.
InventoryFiles, routes, roles, data, environments; endpoint matrix.
Threat modelFlows, trust boundaries, STRIDE and LINDDUN, chained attack paths.
Identity and authorizationSessions, MFA, OAuth, secrets, object and function access, tenants.
Input, APIs, files, logicInjection, XSS, SSRF, CSRF, webhooks, business logic.
Infrastructure and supply chainDatabase, cryptography, containers, CI/CD, SBOM, recovery.
AI and automation if presentPrompt injection, RAG, tools and agents.
Availability and cost only if authorizedApplication-level DoS and denial of wallet, with numeric limits and stop thresholds.
PrivacyReal processing versus the privacy notice: handed to gdpr-sentinel.
Validation and planFalse positives, refutation of high findings by an independent verifier, deduplication, retest, open questions for decision-makers.

Anatomy of a finding

Every finding also says how well it is proven

Pick a state: see what it means and what it takes to move up a level. Anonymized example.

HIGHDemo seed endpoint exempt from authentication, creates users with a fixed password

Stateconfirmed from code or configuration · medium confidence

EvidenceThe middleware lists the path among the public ones; the handler checks neither session, role nor token.

Expected / observedExpected: disabled in production or protected by role. Observed: reachable without authentication.

ImpactReal: not demonstrated, no test run. Potential: creation of accounts with a known password.

ImmediatelyBlock the path at the reverse proxy; check whether demo accounts exist in production.

RetestAnonymous request on staging: expect 401 or 404, no user created.

LimitsNot verified whether the route is in the production build.

RefutationA verifier other than the author tried to prove it wrong and did not manage to (outcome "resiste", i.e. holds).

A real case, anonymized

What comes out of a quick assessment

Next.js web application with PostgreSQL, four roles, Docker deployment. quick mode, static analysis only, owner and developer are the same person. Names and identifiers were removed.

2 high

findings out of 7, plus 5 medium or low

0 reproduced

no dynamic testing was authorized: all "confirmed from code"

14 of 309

API routes read; over 280 remain "unknown"

0 of 9

inventoried endpoints with a test run

ID	Severity	What
APP-002	high	Demo seed endpoint exempt from authentication, creates users with a fixed password
APP-005	high	Framework and authentication library with known advisories, including middleware bypass
APP-003	medium	Debug and seed routes without a role check, mutations via GET
APP-004	medium	Quote acceptance without an ownership check, temporary password in the response
APP-001	medium	"Example" configuration file with real-looking values, tracked in Git

Five of the seven findings. The assessment also found a gap between the privacy notice and the code: the page says "no transfers outside the EEA", while the code loads fonts from Google and sends messages through a US supplier. On the contractual side the skill states "not verifiable" and prepares the questions.

The most useful question in the report: are these routes in the production build? A "high" finding can be irrelevant or urgent depending on the answer, and the skill does not pretend to know it.

Automation

Scripts that speed things up without deciding for you

Python standard library only, except PDFs (reportlab) and the cookie scan (playwright). Each one states its own limit.

Script	What it does	Declared limit
`inventory_routes.py`	Lists routes and methods (Next.js, Express, Flask, FastAPI, Django, Laravel, Spring, ASP.NET, Rails, Go) and flags those with no evident authentication	Heuristic: does not prove that a control is correct or absent
`dynamic_authz_check.py`	Tests access per identity	Localhost or an authorized host only; read-only by default; no response body stored
`prepass.py`	Every tool in a fixed order, 14-area checklist pre-filled	Same output between runs; candidates are hypotheses
`merge_audits.py`	Merges several runs on the same repo and measures agreement	A cause seen by one run only is not less true
`run_scanners.py`	Dependencies from the lockfile alone and secrets in Git history, ranked without ever showing the value	Heuristic; if a scanner cannot run it says so
`import_openapi.py`	Imports OpenAPI/Swagger and compares it with the routes in the code	The spec states intent, it does not prove protection
`iac_check.py`	14 rules on Docker, compose, Kubernetes, Terraform, GitHub Actions	Pattern-based hints, does not replace trivy/checkov
`import_scanner.py`	Imports npm audit, SARIF, gitleaks, osv, semgrep, trivy, ZAP	Always hypotheses, severity never above "medium", secrets never reported
`verify_findings.py`	Reviewer: nonexistent references, severity without evidence, duplicates; refutation brief for high findings	Mechanical: questions and refutation stay with the reader
`coverage_carry.py`	Repeated audits: carries over coverage for unchanged content, marks changed items and never-covered files	The fingerprint proves the content did not change, not that the past review was right
`redact_check.py`	Looks for secrets and personal data in files and PDFs	Never prints the value; a clean result is no guarantee
`cookie_scan.py`	Cookies, storage and third parties before consent, clean browser	Local URLs or with the controller's confirmation
`draft_ropa.py`	Draft Art. 30 register and supplier list from the code	All "hypotheses": roles and legal bases are confirmed by the controller
`draft_dpia.py`	Draft DPIA sheet (Art. 35) from the processing map, with need indicators	Not a DPIA and does not decide whether one is needed: the controller decides with the DPO
`retention_check.py`	Deletion evidence compared with declared retention times	Absence of evidence is not a violation
`check_delivery.py`	A single check before delivery: schema, refutations of high findings, GDPR matrix, redaction (including the app's secret values), forbidden words, coverage	Mechanical: a clean result does not prove the audit is correct; it cannot see chat messages
`canonicalize.py`	Converts English states and severities to the canonical Italian values the scripts check	Touches only enumerated values, never free text
`compare_audits.py`, `export_findings.py`	Retest between two audits; CSV, SARIF, Markdown	"Resolved" means absent, not verified
`build_report_pdf.py`	PDF report: full, `--sintetico`, `--lang en`, `--previous`, `--nis2`	The NIS2 mapping is indicative, not a compliance assessment

The scripts are tested against fake apps and pages with known flaws, including a local instance and a page in the browser (tests/run_checks.py). This is not a benchmark on public vulnerable apps. Short English guide: README.en.md in each repository.

PDF report

A document you can hand to a client

Cover, index, owner summary, findings, documentary audit, coverage matrices, questions and action plan. Teal theme for security, amber for privacy. Click a page to enlarge it. The sample pages are from an Italian-language report.

Security report cover — Cover · security

Summary with severity donut chart — Summary and priorities

Findings overview with severity labels — Findings overview

Coverage and endpoint matrices — Coverage matrices

Privacy report cover in amber — Cover · privacy

Options: --sintetico for management, --lang en for English labels, --previous to compare with an earlier audit, --nis2 for an indicative mapping to the Art. 21 measures.

Installation

Ready in two minutes

Download appsec-sentinel.skill and gdpr-sentinel.skill from the repositories' Releases.
Upload them from the skills settings.
Type /appsec-sentinel quick <repo>: it will ask about ownership, type of activity and mode before touching anything.

/plugin marketplace add dextsamu/appsec-sentinel
/plugin install appsec-sentinel@appsec-sentinel
/plugin install gdpr-sentinel@appsec-sentinel     # the twin skill, optional

As a plugin it updates with new releases. Or as a folder: git clone https://github.com/dextsamu/appsec-sentinel ~/.claude/skills/appsec-sentinel (for a single project into <project>/.claude/skills/). For the PDF report: pip install reportlab.

Antigravity: the project's .agents/skills/<skill-name>/ folder, or ~/.gemini/config/skills/ for all projects. Codex: a third-party source gives ~/.codex/skills/<skill-name>/, to be checked with codex --help.

Built for Claude, tried once each on Codex and Antigravity (Windows, quick mode, fake app, static analysis only). Paths, limits and the checks to run are in docs/ALTRI-AGENTI.md in the repository (Italian).

Commands

One word and you are off

Type the command after the skill name. Every command also works with its Italian name (quick = rapido, refute = smentita, close = chiudi…). No command skips the authorization gate. Chat, findings and reports follow your language.

Command	What it does
`quick <repo>`	Targeted triage, static analysis
`standard <repo> [url]`	Threat model, static analysis, authorized dynamic checks
`inventory <repo>`	Endpoint matrix, routes with no evident authentication first
`scanner <file…>`	Imports scanners as hypotheses to validate
`dynamic <config> <test>`	Access tests on localhost or an authorized host
`documentary <repo>`	Documents versus code
`review` · `refute`	False positives; a verifier other than the author tries to refute the high findings
`resume` · `redact`	Repeated audit with carried-over coverage; secrets and personal data before delivery
`close`	Delivery check in one step: all mechanical checks before sending the audit
`pdf` · `compare` · `export`	Report, retest, CSV/SARIF/Markdown

Command	What it does
`static <repo>`	Real processing and the A–N matrix from the code
`draft-register <repo>`	Draft Art. 30 register and suppliers, all "hypotheses to validate"
`draft-dpia <mappa>`	Draft DPIA sheet with need indicators; not a DPIA
`data-subject-request`	Sheet, checks and reply texts for data-subject rights
`notice <repo>`	Privacy notice versus code
`cookie <repo> [url]`	Cookies and third parties before consent
`retention <repo>`	Deletion evidence and declared times
`suppliers` · `questions`	Suppliers and transfers; questions for the controller, DPO, counsel
`refute` · `close`	A verifier other than the author tries to refute the gaps; delivery check in one step
`redact` · `pdf` · `compare`	Pre-delivery check, report, retest
`security <repo>`	Hands over to appsec-sentinel for Art. 32

Limits

What they do not do

They do not find "all" vulnerabilities and do not certify security or compliance.
They do not replace a penetration tester, a DPO or a lawyer.
They run no tests on production or on unauthorized systems.

They do not change the product: they propose fixes to apply under a later mandate.
They do not run tools they lack: they prepare the commands for the client's environment.
They do not send secrets, personal data or private code to third-party services without authorization.

Responsible use. Use them only on your own systems or with the owner's written authorization: unauthorized access to a computer system can be a criminal offence. Reports contain sensitive details: keep them out of Git and public repositories.

Frequently asked questions

FAQ

Can I use them on a client's site?

Only with the written authorization of the system owner. The skills run no active tests without a confirmed scope, but responsibility for their use stays with you.

Do the scripts replace scanners?

No. The scanners stay yours: the skills import their output as "hypothesis to validate" candidates and handle rules, coverage, validation and the report.

Does "no findings" mean it is secure?

No. Coverage only concerns what was inventoried and proven: the report says how much was really examined and how much remains unknown.

Is the draft processing register the Art. 30 register?

No: it is a draft derived from the code, entirely "hypothesis to validate". Roles, legal bases, countries and retention periods are confirmed by the controller.

Do they work with other agents, not only Claude?

They were tried once on Codex and once on Antigravity (Windows, quick mode, fake app, static analysis only): the rules were respected and the gaps that emerged were fixed. This is not a guarantee of compatibility: the guide with install paths and limits is in docs/ALTRI-AGENTI.md in the repository (Italian).

Do I need both installed?

No. They work separately. If both are installed, one hands work to the other and the report is a single one.

Where do the audit files go?

In a confidential folder created outside the repository. Secrets never enter the reports: only location, type and shape are recorded.