Subagent

Octopus Security Audit

Comprehensive security auditing skill leveraging the security-auditor persona. Use for vulnerability scanning, OWASP compliance checks, and security reviews.

Type: Subagent
Repository: nyldn/claude-octopus
GitHub stars: 4.1k
License: MIT
Repo last updated: Sep 26, 2026
Source file: agents/skills/security-audit.md

What Octopus Security Audit is

Octopus Security Audit is a subagent published in the nyldn/claude-octopus repository on GitHub, which has about 4.1k stars. The repository describes itself as: “Run multiple AI models against the same research, design, or coding task. Surface disagreements before you ship.”

A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.

Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Octopus Security Audit and get back a compact result.

How to install Octopus Security Audit

Claude Code

Download security-audit.md from the repository.
Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.

Claude Cowork

Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from agents/skills/security-audit.md, shared under the repository's MIT license. Read the full file on GitHub.

Invokes the security-auditor persona for thorough security analysis during the ink (deliver) phase.

Usage

# Via orchestrate.sh
./scripts/orchestrate.sh spawn security-auditor "Scan for SQL injection vulnerabilities"

# Via auto-routing (detects security intent)
./scripts/orchestrate.sh auto "security audit the payment processing module"

Capabilities

OWASP Top 10 vulnerability detection
SQL injection and XSS scanning
Authentication/authorization review
Secrets and credential detection
Dependency vulnerability assessment
Security configuration review

Persona Reference

This skill wraps the security-auditor persona defined in:

agents/personas/security-auditor.md
CLI: codex-review
Model: gpt-5.2-codex
Phases: ink
Expertise: owasp, vulnerability-scanning, security-review

Example Prompts

"Scan for hardcoded credentials in the codebase"
"Check for CSRF vulnerabilities in form handlers"
"Review the API authentication implementation"
"Analyze the encryption at rest configuration"

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Octopus Security Audit?

Octopus Security Audit is a subagent for Claude Code and Claude Cowork from the nyldn/claude-octopus repository on GitHub. Comprehensive security auditing skill leveraging the security-auditor persona. Use for vulnerability scanning, OWASP compliance checks, and security reviews.

How do I install Octopus Security Audit in Claude Code?

Download security-audit.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.

Can I use Octopus Security Audit in Claude Cowork?

Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.

Is Octopus Security Audit safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under MIT. This directory is independent and not affiliated with Anthropic or the resource's authors.