claude-security-agents

48 个用于全栈网络安全的专用 Claude Code 子代理。
蓝队 · 红队 · 紫队 · DevSecOps · GRC · 事件响应 · 代码审计

零依赖。仅包含 Markdown 文件。
用自然语言描述安全任务 — 合适的代理会负责处理。

## 工作原理 ``` You: "Write a Sigma rule for detecting DCSync attacks" └─→ Claude routes to: blue-detection-rules └─→ Produces: Sigma YAML with ATT&CK T1003.006 mapping, SPL translation, FP guidance You: "Audit this Dockerfile for security issues" └─→ Claude routes to: devsecops-container └─→ Produces: CIS Docker Benchmark findings with remediated snippets You: "Map T1059.001 — show me the attack AND the detection" └─→ Claude routes to: purple-attack-detect-map └─→ Produces: Dual attack/detect document with procedures and Sigma rules ``` 无需配置。无需 API 密钥。无需外部工具。安装代理，打开 Claude Code，即可开始。 ## 快速开始 ``` # 一键安装（全部 48 个 agent） curl -fsSL https://raw.githubusercontent.com/AbrahamOP/claude-security-agents/main/install.sh | bash # 或首先 clone git clone https://github.com/AbrahamOP/claude-security-agents.git cd claude-security-agents ./install.sh --global ``` **选项：** ``` ./install.sh --category blue,ir # Install specific categories only ./install.sh --project # Install in current project (not global) ./install.sh --lite # Use Claude Haiku (cheaper) for advisory agents ./install.sh --uninstall # Clean removal ./install.sh --status # Show what's installed ``` ## 代理映射 ``` graph TB subgraph "BLUE TEAM" B1[detection-rules] B2[siem-analyst] B3[threat-hunter] B4[ids-tuner] B5[email-analyst] B6[log-analyzer] B7[forensics-triage] B8[vuln-manager] end subgraph "RED TEAM" R1[recon] R2[webapp] R3[privesc] R4[cloud-attack] R5[social-engineer] R6[api-security] R7[ad-attack] R8[payload-craft] R9[wireless] end subgraph "PURPLE TEAM" P1[adversary-emulation] P2[threat-model] P3[attack-detect-map] P4[detection-gap] end subgraph "DEVSECOPS" D1[code-review] D2[container] D3[pipeline] D4[iac-scanner] D5[secrets-scanner] D6[k8s-security] D7[sbom] end subgraph "GRC" G1[compliance-auditor] G2[policy-writer] G3[risk-assessor] G4[audit-prep] end subgraph "IR & FORENSICS" I1[incident-handler] I2[forensics] I3[malware-analyst] I4[threat-intel] I5[playbook-builder] I6[evidence-handler] end subgraph "CODE AUDIT" A1[go] A2[python] A3[javascript] A4[java] A5[rust] A6[c-cpp] A7[php] A8[ruby] A9[api] A10[infra-code] end SG[/_scope-guard.md/] SG -.->|enforced by| R1 & R2 & R6 & R7 P3 -.-> SG ``` ## 所有代理 ### 蓝队 — 防御与检测 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `blue-detection-rules` | T2 | 编写 Sigma、SPL、KQL 和 YARA 规则，包含 ATT&CK 映射和 FP 调优 | | `blue-siem-analyst` | T1 | 对 SIEM 警报进行分类，构建关联逻辑，优化查询 | | `blue-threat-hunter` | T2 | 使用 ATT&CK 剧本运行假设驱动的威胁狩猎 | | `blue-ids-tuner` | T2 | 编写和调优 Suricata/Snort 规则，管理误报 | | `blue-email-analyst` | T1 | 分析电子邮件标头、SPF/DKIM/DMARC，提供钓鱼判定 | | `blue-log-analyzer` | T1 | 跨日志格式解析和关联安全事件 | | `blue-forensics-triage` | T2 | 首选响应人员实时分类 — 易失性数据收集与保存 | | `blue-vuln-manager` | T1 | 漏洞生命周期 — 分类、EPSS/KEV 优先级排序、SLA 跟踪 | ### 红队 — 攻击与利用 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `red-recon` | T2 | 被动/主动侦察 — 子域名、端口、技术栈、攻击面 | | `red-webapp` | T2 | OWASP Top 10 测试 — 注入、身份验证绕过、业务逻辑 | | `red-api-security` | T2 | API 渗透测试 — REST、GraphQL、IDOR、失效的身份验证、速率限制 | | `red-ad-attack` | T2 | 活动目录 (Active Directory) — Kerberoast、BloodHound、横向移动、域管理员 | | `red-privesc` | T1 | Linux/Windows 权限提升路径分析和建议 | | `red-cloud-attack` | T1 | 云攻击路径 — IAM 提权、元数据滥用 (AWS/Azure/GCP) | | `red-social-engineer` | T1 | 钓鱼活动设计、借口、语音钓鱼脚本、安全意识测试 | | `red-payload-craft` | T1 | 负载 (Payload) 制作建议 — msfvenom、编码、规避技术 | | `red-wireless` | T1 | WiFi/BLE 安全评估 — WPA 破解、恶意 AP、握手分析 | ### 紫队 — 桥接攻击与防御 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `purple-adversary-emulation` | T1 | 规划映射 ATT&CK 的对手模拟演练 | | `purple-threat-model` | T1 | 包含风险评级场景的 STRIDE/PASTA 威胁建模 | | `purple-attack-detect-map` | T2 | **独特功能** — 并排生成攻击程序和检测规则 | | `purple-detection-gap` | T1 | 评估 ATT&CK 检测覆盖率并识别盲点 | ### DevSecOps — 安全左移 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `devsecops-code-review` | T1 | 安全代码审查 — 注入、身份验证、机密、CWE/OWASP 映射 | | `devsecops-container` | T2 | 使用 CIS Docker Benchmark 进行 Dockerfile/compose 加固 | | `devsecops-pipeline` | T1 | CI/CD 安全审计 — GitHub Actions、GitLab CI、SLSA 对齐 | | `devsecops-iac-scanner` | T2 | Terraform/CloudFormation/K8s manifest 配置错误检测 | | `devsecops-secrets-scanner` | T2 | 检测代码、git 历史记录和配置文件中泄露的机密 | | `devsecops-k8s-security` | T2 | Kubernetes RBAC、Pod 安全、网络策略、CIS K8s Benchmark | | `devsecops-sbom` | T2 | SBOM 生成、依赖项 CVE 扫描、许可证合规性、供应链风险 | ### GRC 与合规 — 治理与认证 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `grc-compliance-auditor` | T1 | 差距分析 — CIS、NIST 800-53、ISO 27001、SOC 2、PCI-DSS、NIS2 | | `grc-policy-writer` | T2 | 起草安全策略 — IR 计划、AUP、访问控制、BCP/DRP | | `grc-risk-assessor` | T1 | 风险评估 — ISO 27005、NIST 800-30、FAIR、EBIOS RM | | `grc-audit-prep` | T1 | 审计准备 — 证据映射、差距优先级排序、访谈准备 | ### 代码审计 — 深入特定语言的安全审查 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `audit-go` | T1 | Go — goroutine 泄漏、竞态条件、defer 顺序、模板注入、加密误用 | | `audit-python` | T1 | Python — eval/pickle、SSTI、Django/Flask/FastAPI 框架特定缺陷 | | `audit-javascript` | T1 | JS/TS — 原型污染、XSS、ReDoS、Express/React/Next.js/Vue 问题 | | `audit-java` | T1 | Java — 反序列化、XXE、SpEL 注入、Spring Boot Actuator 暴露 | | `audit-rust` | T1 | Rust — unsafe 块、FFI 边界、整数溢出、transmute 合理性 | | `audit-c-cpp` | T1 | C/C++ — 缓冲区溢出、格式化字符串、释放后重用 (use-after-free)、编译器加固标志 | | `audit-php` | T1 | PHP — SQLi、LFI/RFI、类型混淆、Laravel/WordPress/Symfony 细节 | | `audit-ruby` | T1 | Ruby — eval/send 滥用、YAML 反序列化、Rails 批量赋值、SSTI | | `audit-api` | T1 | API — 映射到 OWASP API Security Top 10 (2023) 的 REST/GraphQL/gRPC 审计 | | `audit-infra-code` | T1 | 基础设施 — Shell 脚本、Ansible、systemd、cron、Dockerfiles、CI/CD 配置 | ### IR 与取证 — 响应与调查 | 代理 | 级别 | 功能 | |:------|:----:|:-------------| | `ir-incident-handler` | T2 | NIST SP 800-61 事件协调 — 从分类到经验教训 | | `ir-forensics` | T1 | 数字取证建议 — 磁盘、内存、网络证据分析 | | `ir-malware-analyst` | T1 | 静态/动态恶意软件分析、IOC 提取、YARA 生成 | | `ir-threat-intel` | T2 | IOC 丰富、活动关联、Diamond Model TI 报告 | | `ir-playbook-builder` | T2 | 构建带有决策树和指标的结构化 IR 剧本 | | `ir-evidence-handler` | T1 | 监管链、取证镜像、证据保存 (RFC 3227/ISO 27037) | ## 级别系统 | | 级别 1 — 建议 | 级别 2 — 执行 | |---|---|---| | **执行命令** | 否 | 是（需用户批准） | | **写入文件** | 否 | 是 | | **需要范围** | 否 | 是（攻击性代理） | | **风险等级** | 无 | 可控 | | **最适合** | 分析、指导、报告 | 扫描、测试、规则编写 | 所有 T2 级别的攻击性代理均强制执行 [Scope Guard](agents/_scope-guard.md) — 强制目标声明、硬性拒绝列表和 OPSEC 标记 (PASSIVE/LIGHT/ACTIVE/LOUD)。 ## 自定义 **更改模型** — 编辑任意代理的 frontmatter： ``` model: haiku # cheaper, good for Tier 1 advisory model: sonnet # default, balanced model: opus # most capable, complex analysis ``` **添加上下文** — 将您的环境详情（SIEM 平台、云提供商、合规范围）附加到任意代理的 body 中。 **Fork 与扩展** — 每个代理都是一个独立的文件。添加您自己的内容，修改现有的内容，或提交 PR。 ## 示例

蓝队示例

``` "Write a Sigma rule for detecting Kerberoasting via Event ID 4769" "Triage this Wazuh alert — rule 5712, brute force from 185.220.101.x" "Hunt for living-off-the-land binaries in these Windows event logs" "Analyze this email — From says paypal.com but Return-Path is different" "Parse these Apache access logs and find suspicious patterns" ```

红队示例

``` "Enumerate the attack surface for target.example.com" "Test this login form for SQL injection and auth bypass" "I have a shell as www-data on Ubuntu 22.04, what are my privesc options?" "Enumerate this AD environment — find a path to Domain Admin" "Test this GraphQL API for IDOR and broken authorization" ```

紫队示例

``` "Map T1059.001 (PowerShell) — show me both attack and detection" "Plan an adversary emulation exercise based on APT29 TTPs" "Threat model this microservices architecture with public API" "Assess our ATT&CK detection coverage and identify the top 10 gaps" ```

DevSecOps 示例

``` "Review this Python Flask app for security vulnerabilities" "Audit this Dockerfile and docker-compose.yml" "Check this GitHub Actions workflow for security risks" "Scan this Terraform config for AWS misconfigurations" "Search this repo's git history for leaked secrets" "Audit this Kubernetes deployment for pod security issues" ```

代码审计示例

``` "Security audit this Go HTTP handler for injection and race conditions" "Review this Python Django app — check for ORM injection and CSRF bypass" "Audit this React/Next.js app for XSS and SSR data leaks" "Check this Java Spring Boot app for deserialization and actuator exposure" "Audit these unsafe blocks in my Rust codebase" "Review this C codebase for buffer overflows and format string vulns" "Audit this Laravel app for mass assignment and type juggling" "Security review this Rails controller for SQL injection and SSTI" "Audit this GraphQL API for introspection, depth limits, and BOLA" "Review these bash scripts and Ansible playbooks for hardcoded secrets" ```

GRC 示例

``` "Map our controls against NIST 800-53 and identify gaps" "Draft an incident response policy for a SaaS company" "Run a risk assessment on our cloud infrastructure" "Prepare us for the upcoming SOC 2 Type II audit" ```

IR 与取证示例

``` "Coordinate the response — lateral movement detected from workstation" "Walk me through analyzing this suspicious PE binary" "Enrich these IOCs: 185.220.101.42, evil.xyz, SHA256:a1b2c3..." "Build an IR playbook for ransomware incidents" "Triage this live system — collect volatile data before imaging" ```

## 要求 - [Claude Code](https://claude.ai/code) CLI、桌面版或网页版 - Claude API 访问权限（推荐使用 Sonnet，Haiku 适用于 T1 级别） - 就这些。没有其他依赖项。 ## 免责声明 仅限授权的安全测试 — 请参阅 [DISCLAIMER.md](DISCLAIMER.md)。 ## 许可证 [MIT](LICENSE)

标签：AI智能体, BurpSuite集成, DevSecOps, DLL 劫持, DNS通配符暴力破解, Metaprompt, OpenCanary, 上游代理, 动态调试, 域环境安全, 大语言模型, 应用安全, 网络安全, 防御加固, 隐私保护