cyber-neo - Open-source cybersecurity analysis agent for Claud

项目说明

<di="center">

<img src="assets/cyber-neo-hero.png" alt="Cyber Neo — Claw'd, the open-source cybersecurity mascot, holding a green padlock shield" width="820">

CYBER NEO

The Open-Source Cybersecurity Agent for Claude Code

Protect your apps. Protect your users. Protect your community.

![License: MIT]()
![OWASP 2025]()
![CWE Top 25-00ff41.svg)]()
![Claude Code]()
![Community]()
![Instagram]()

---

*Shipped by | Built by the Tododeia community — empowering de to ship secure software.*

</div>

---

What is Cyber Neo?

Cyber Neo is a comprehensi analysis agent that runs inside Claude Code. Point it at any project on your computer, and it performs a deep security audit — scanning your code, dependencies, secrets, infrastructure, and supply chain for . It generates a professional, prioritized report with actionable remediation guidance so you can fix issues before they become incidents.

No security expertise required. Just run /cyber-neo and let the agent do the work.

Cyber Neo was built with a mission: our community at tododeia.com is building apps, tools, and products. We want to help every de in the community protect what they're building. This agent is our contribution — open source, free, and designed to be the most thorough security scanner a as a Claude Code skill.

---

Why Cyber Neo?

Most security tools require installation, configuration, and expertise to interpret results. Cyber Neo is different:

| Traditional Security Tools | Cyber Neo |
|---|---|
| Require installation and setup | Works instantly as a Claude Code skill |
| Need security expertise to interpret | Plain-language findings with code-le |
| Scan one category (SAST *or* SCA *or* secrets) | Scans 11 categories in one run |
| Output raw findings without context | CWE/OWASP-classified findings with fix examples |
| Run sequentially | 5 parallel subagents for speed |
| Require paid licenses for full co | 100% free and open source |

---

What It Scans

<di="center"><img src="assets/claw-d-scanner.png" alt="Claw'd inspecting code with a magnifying glass and spotting a bug" width="280"></div>

Cyber Neo covers 11 security domains across every major class:

| # | Category | What It Finds | How |
|---|----------|--------------|-----|
| 1 | Code Security (SAST) | SQL injection, XSS, command injection, code injection, path tra, SSRF, deserialization, prototype pollution | Semgrep (optional) + Claude-nati analysis |
| 2 | Authentication & Authorization | Missing auth middleware, JWT misconfigurations, broken access control, IDOR, session management flaws, missing RBAC | Claude-nati using auth-authz-patterns.md |
| 3 | Cryptographic Security | Weak algorithms (MD5, SHA1, DES, RC4), hardcoded keys/IVs, TLS bypass, insecure random, weak key lengths | Claude-nati using crypto-patterns.md |
| 4 | Secret Detection | 60+ regex patterns: AWS, GCP, Azure, GitHub, Slack, Stripe, database credentials, private keys, API keys, JWT tokens, .en | Python batch scanner + Gitleaks (optional) |
| 5 | Dependency (SCA) | Known CVEs in npm, pip, cargo, bundler, composer, and Go dependencies | Trivy / npm audit / pip-audit / cargo-audit (optional) |
| 6 | Web Security | Missing security headers (CSP, CORS, HSTS), CSRF, cookie flags, file upload flaws, open redirects | Claude-nati using web-security-patterns.md |
| 7 | Supply Chain Security | Lock file integrity, dependency confusion, typosquatting, unpinned , malicious packages | Python lockfile checker + Claude-nati |
| 8 | CI/CD Security | GitHub Actions script injection, overly permissi, unpinned actions, secret exposure in workflows | Claude-nati using cicd-security.md |
| 9 | Docker & Container Security | Root user, unpinned base images, secrets in layers, pri containers, Docker socket exposure | Claude-nati using iac-docker.md |
| 10 | Error Handling | Debug mode in production, stack trace exposure, empty catch blocks, missing error boundaries | Claude-nati using error-handling-patterns.md |
| 11 | Logging Security | Sensitive data in logs, log injection, missing security event logging | Claude-nati using logging-patterns.md |

Standards Co

Cyber Neo maps every finding to industry standards:

---

Supported Languages & Frameworks

| Language | Frameworks | Reference File |
|----------|-----------|---------------|
| Ja / TypeScript | Express, Next.js, React, Vue, Angular, Fastify, NestJS, Koa, Electron | lang-ja.md (924 lines) |
| Python | Django, Flask, FastAPI, Tornado, Starlette | lang-python.md (935 lines) |
| Any language | Generic SAST patterns (eval, exec, hardcoded creds, command injection) | Built into SKILL.md |

> Coming in v0.2: Go, Ruby/Rails, Ja, Rust, PHP/Laravel

---

Installation

Option 1: Clone to Skills Directory (Recommended)

That's it. Claude Code automatically discovers the skill.

Option 2: Symlink from Any Location

Option 3: Claude Code Plugin Marketplace

> *Marketplace a coming soon.*

Installation

Open Claude Code and type:

If installed correctly, Cyber Neo will ask you for a project path to scan.

---

Usage

Basic Scan

What Happens When You Run It

Output

The report is saved to your Desktop:

---

Report Format

Every Cyber Neo report includes:

Executi

Detailed Findings

Each finding includes:

Additional Sections

---

How It Works — Architecture Deep Dive

<di="center"><img src="assets/claw-d-architecture.png" alt="Claw'd analyzing code on a terminal showing a passing check" width="280"></div>

Cyber Neo is built as a Claude Code skill — a markdown-based prompt that orchestrates Claude's analysis capabilities. The architecture has three layers:

Layer 1: SKILL.md — The Orchestration Engine

The SKILL.md file (563 lines) is the brain of Cyber Neo. It contains:

Layer 2: Reference Files — The Security Knowledge Base

14 reference files totaling 10,000+ lines of security patterns:

Each reference file contains:

Layer 3: Python Scripts — Batch Processing

Two Python scripts handle tasks where batch processing is faster than sequential Claude analysis:

| Script | Purpose | Lines |
|--------|---------|-------|
| scan_secrets.py | Regex-based secret scanning across all files. 60+ patterns co AWS, GCP, GitHub, Slack, Stripe, database credentials, private keys, API keys, and more. Includes smart allowlisting to reduce false positives. | 510 |
| check_lockfiles.py | Lock file integrity for 10 package managers (npm, yarn, pnpm, bun, pip, pipen, cargo, bundler, composer, Go). Detects missing lock files, unpinned dependencies, and risky lifecycle scripts. | 340 |

Both scripts:

---

Optional: External Tool Integration

Cyber Neo works out of the box using Claude-nati. For deeper scanning, install these optional tools:

| Tool | Category | Install | What It Adds |
|------|----------|---------|-------------|
| Semgrep | SAST | brew install semgrep | 3,000+ community rules for 30+ languages |
| Trivy | SCA | brew install trivy | Comprehensi database |
| Gitleaks | Secrets | brew install gitleaks | Git history scanning for committed secrets |
| pip-audit | Python SCA | pip install pip-audit | Python package checking |
| cargo-audit | Rust SCA | cargo install cargo-audit | Rust crate checking |

When these tools are installed, Cyber Neo automatically detects and uses them alongside its built-in analysis for deeper co.

---

Scope Tiering — How It Handles Large Projects

Cyber Neo adapts its scanning strategy based on project size:

| Tier | File Count | Strategy |
|------|-----------|----------|
| Small | < 1,000 | Full scan — every source file analyzed |
| Medium | 1,000 - 10,000 | Targeted scan — prioritizes src/, app/, API routes, auth middleware, config files |
| Large | 10,000+ | Critical-path scan — focuses on entry points, auth, config, deps. Reports co percentage |

The final report always shows how many files were scanned , so you know exactly what was covered.

---

Safety Guarantees

<di="center"><img src="assets/claw-d-shield.png" alt="Claw'd standing guard behind a shield with a green padlock — the read-only iron law" width="280"></div>

Cyber Neo follows a strict read-only iron law:

| Rule | Description |
|------|-------------|
| Ne files | Your project files are ne, deleted, or created |
| Ne code | No npm start, python app.py, or any project execution |
| Ne packages | No npm install, pip install, or dependency modifications |
| Never runs fix commands | No npm audit --fix or auto-remediation |
| Single write operation | Only writes the report file to ~/Desktop/ |
| Secrets are redacted | Detected secrets are ne in the report |

These constraints are enforced at the top level AND in every subagent prompt.

---

OWASP 2025 Top 10 Co Map

| ID | Category | Where Addressed |
|----|----------|----------------|
| A01:2025 | Broken Access Control | auth-authz-patterns.md — missing middleware, IDOR, pri escalation |
| A02:2025 | Security Misconfiguration | web-security-patterns.md + error-handling-patterns.md — headers, debug mode, en |
| A03:2025 | Software Supply Chain Failures | supply-chain.md + cicd-security.md — dep confusion, typosquatting, CI injection |
| A04:2025 | Cryptographic Failures | crypto-patterns.md + secrets-patterns.md — weak algorithms, hardcoded keys |
| A05:2025 | Injection | lang-ja.md + lang-python.md + web-security-patterns.md — SQLi, XSS, SSRF |
| A06:2025 | Insecure Design | auth-authz-patterns.md + web-security-patterns.md — structural design flaws |
| A07:2025 | Authentication Failures | auth-authz-patterns.md — JWT, sessions, password hashing, OAuth |
| A08:2025 | Software/Data Integrity Failures | lang-*.md + supply-chain.md — deserialization, dependency integrity |
| A09:2025 | Logging/Monitoring Failures | logging-patterns.md — sensitive data in logs, missing security logging |
| A10:2025 | Mishandling of Exceptional Conditions | error-handling-patterns.md — empty catches, stack traces, debug mode |

---

Remediation Workflow

After running Cyber Neo, we recommend a test-dri fix approach:

If you have the Superpowers plugin installed, use its TDD workflow for structured remediation.

---

Skill Integration

Cyber Neo works with other Claude Code skills for enhanced analysis:

| Skill | Integration |
|-------|------------|
| /last30days | Researches emerging threats and community discussions about your detected stack |
| /deep-research | Looks up context on unfamiliar CVEs or emerging threats found during scan |
| Superpowers | TDD-dri workflow for fixing findings systematically |

---

Project Structure

---

Roadmap

v0.1.0 (Current)

v0.2.0 (Planned)

v0.3.0 (Future)

---

Contributing

We welcome contributions from the community. See CLAUDE.md for detailed contributor guidelines.

Key Principles

1. SKILL.md is the product — its quality determines how good the agent is
2. Reference files are pure knowledge — grep-ready patterns with CWE/OWASP mappings
3. Scripts use only standard library — zero pip dependencies
4. Every finding needs classification — CWE ID, OWASP category, se, and remediation
5. Read-only on target projects — ne what we're scanning

How to Add a New Language

1. Create references/lang-{language}.md following the existing pattern
2. Add framework detection patterns, patterns with grep regex, and secure/ code examples
3. Map every pattern to CWE and OWASP 2025 categories
4. Update SKILL.md Phase 1.1 to detect the new language
5. Update SKILL.md Phase 1.3 to load the new reference file
6. Test against a deliberately project in that language

---

Community

<di="center"><img src="assets/claw-d-community.png" alt="Claw'd waving and holding up an A+ security report" width="280"></div>

Cyber Neo is shipped by and built by the Tododeia community — a growing network of de building apps, tools, and products together. We belie de deser to enterprise-grade security tooling, for free.

---

Acknowledgments

Cyber Neo builds on the shoulders of the security community:

---

<di="center">

Shipped by | Built with purpose. Open source forever.

*Protecting the apps our community builds — one scan at a time.*

Get Started | Report an Issue | Join the Community | Follow

</div>

项目信息

开发语言：Python

Star 数：279

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 categories. 11 security domains, 60+ secret patterns, parallel subagent analysis, professional report generation. Built by tododeia.com展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。