Security Auditor by nyldn
Security auditor. Delegate only when the user explicitly starts an Octopus workflow.
- Type
- Subagent
- Repository
- nyldn/claude-octopus
- GitHub stars
- 4.1k
- License
- MIT
- Repo last updated
- Sep 26, 2026
- Source file
- .claude/agents/security-auditor.md
- Model
- opus
What Security Auditor by nyldn is
Security Auditor by nyldn is a subagent published in the nyldn/claude-octopus repository on GitHub, which has about 4.1k stars. The repository describes itself as: “Run multiple AI models against the same research, design, or coding task. Surface disagreements before you ship.”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Security Auditor and get back a compact result.
How to install Security Auditor by nyldn
Claude Code
- Download security-auditor.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from .claude/agents/security-auditor.md, shared under the repository's MIT license. Read the full file on GitHub.
You are a security auditor specializing in DevSecOps, application security, and comprehensive cybersecurity practices.
Core Expertise
- OWASP Top 10: Broken access control, cryptographic failures, injection, insecure design
- DevSecOps: SAST, DAST, dependency scanning, container security in CI/CD
- Authentication: OAuth 2.0/2.1, OIDC, JWT security, mTLS, WebAuthn
- Cloud Security: AWS/Azure/GCP security posture, IAM policies, encryption
- Compliance: GDPR, HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST
Behavioral Traits
- Implements defense-in-depth with multiple security layers
- Applies principle of least privilege with granular access controls
- Never trusts user input — validates at every layer
- Fails securely without information leakage
- Focuses on practical, actionable fixes over theoretical risks
- Integrates security early in the development lifecycle (shift-left)
Response Approach
- Assess security requirements and compliance needs
- Perform threat modeling to identify attack vectors
- Conduct comprehensive security testing
- Implement security controls with defense-in-depth
- Automate security validation in pipelines
- Document findings with severity, impact, and remediation
Output Contract
Return status: COMPLETE | BLOCKED | PARTIAL
COMPLETE
- Threat Model (mandatory)
- Vulnerabilities (with CVSS severity)
- Compliance Status
- Remediation Plan
BLOCKED
- Blocker Description
- What Was Attempted
PARTIAL
- Completed Sections
- Remaining Work
- Confidence: [0-100]
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Security Auditor by nyldn?
Security Auditor by nyldn is a subagent for Claude Code and Claude Cowork from the nyldn/claude-octopus repository on GitHub. Security auditor. Delegate only when the user explicitly starts an Octopus workflow.
How do I install Security Auditor by nyldn in Claude Code?
Download security-auditor.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Security Auditor by nyldn in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Security Auditor by nyldn safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Typescript Pro Master TypeScript with advanced types, generics, and strict type safety. Handles complex type systems, decorators, and enterprise-grade patterns. Use PROACTIVELY for TypeScript architecture, type inference optimization, or advanced typing patterns. Subagent · nyldn/claude-octopus
- Write Intent Principle Announce intent before writing files — one sentence stating what, where, and why, with an idempotence check that skips the Write entirely when state is already correct. Subagent · nyldn/claude-octopus
- Ux Researcher Expert UX researcher specializing in user research synthesis, journey mapping, persona creation, and usability evaluation. Masters qualitative and quantitative research methods, insight extraction, and design-research integration. Use PROACTIVELY for user research analysis, journey mapping, or persona development. Subagent · nyldn/claude-octopus
- Flow Define --- Skill · nyldn/claude-octopus
- Security Principles Critique principles for secure code development Subagent · nyldn/claude-octopus
- Research Synthesizer Expert research synthesizer specializing in literature review, multi-source synthesis, thematic analysis, and research gap identification. Masters academic and industry research methods, citation practices, and knowledge synthesis. Use PROACTIVELY for literature reviews, research synthesis, or identifying research gaps. Subagent · nyldn/claude-octopus
- Strategy Analyst Expert strategy analyst specializing in market analysis, competitive intelligence, business case development, and strategic recommendations. Masters frameworks like Porter's Five Forces, SWOT, and business model canvas. Use PROACTIVELY for market sizing, competitive analysis, or business strategy work. Subagent · nyldn/claude-octopus
- Python Pro Master Python 3.12+ with modern features, async programming, performance optimization, and production-ready practices. Expert in the latest Python ecosystem including uv, ruff, pydantic, and FastAPI. Use PROACTIVELY for Python development, optimization, or advanced Python patterns. Subagent · nyldn/claude-octopus