# Security Research

Team Mode security research skill.

- Repository: https://github.com/code-yeongyu/oh-my-openagent (70577 stars)
- Category: Security
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add code-yeongyu/oh-my-openagent --skill security-research -g -a claude-code -y`
Codex: `npx skills add code-yeongyu/oh-my-openagent --skill security-research -g -a codex -y`
Cursor: `npx skills add code-yeongyu/oh-my-openagent --skill security-research -g -a cursor -y`
Gemini CLI: `npx skills add code-yeongyu/oh-my-openagent --skill security-research -g -a gemini-cli -y`

## Description

Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Research - Team Mode Vulnerability Audit

Use this skill to run a parallel security audit that separates real exploitability from generic concern. The team has 3 vulnerability hunters and 2 PoC engineers.

## Hard Preconditions

Before starting, verify:

1. `team_*` tools are available. If not, stop and tell the user:
   `security-research requires team-mode. Set team_mode.enabled: true in your oh-my-openagent config, restart opencode, then retry.`
2. You are in the main session, not a background subagent.
3. You have a concrete target: repository, diff range, PR, release candidate, path list, or threat surface.

If the user provided no target, audit the current repository and current branch diff against its upstream or merge base. If there is no diff, audit the security-sensitive surfaces in the working tree.

## Severity Standard

Use these references as the scoring frame:

- CWE for root-cause weakness classification: https://cwe.mitre.org/
- OWASP WSTG for test methodology: https://devguide.owasp.org/en/06-verification/01-guides/01-wstg/
- OWASP ASVS for control verification: https://owasp.org/www-project-application-security-verification-standard/
- CVSS v4.0 for exploitability and impact scoring: https://www.first.org/cvss/v4.0/specification-document

Rules:

- No severity without an attack path.
- No critical or high finding without concrete exploit preconditions and impact.
- Keep CWE category separate from severity.
- Prefer a small, reproducible PoC over theoretical language.
- Never run destructive exploits against real services or third-party systems.
- Use local fixtures, toy payloads, dry runs, or static proof when real execution would be unsafe.

## Team Roster

Create one Team Mode run with these 5 members:

The rest: https://github.com/code-yeongyu/oh-my-openagent/blob/HEAD/.agents/skills/security-research/SKILL.md