skill
thanos-snap-security
🧤 Defensive, authorization-first cybersecurity assessment skill for Claude Code — reviews websites, frontend code, and mobile artifacts (APK/AAB/IPA) for security weaknesses. Snap to find the villain
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/riteshksingh007/thanos-snap-security itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
README
synced Oct 23, 2026🧤 Thanos Snap Security
Snap to find the villains in code, websites, and apps.
A defensive, authorization-first cybersecurity assessment skill for Claude Code. It reviews websites, frontend codebases, mobile source, and compiled mobile artifacts (Android APK/AAB, iOS IPA) for security weaknesses — exposed secrets, insecure configs, vulnerable dependencies, risky mobile permissions, and weak frontend hygiene — and produces a structured, remediation-focused report.
The "villains" are the security problems. The skill's whole job is to find them safely, statically, and only with authorization — no offensive behavior, no live probing without an explicit go-ahead.
Why this exists
Most "security review" prompts are a single wall of text with no guardrails. This skill is built the opposite way: as a structured workflow with a hard authorization gate, asset-specific playbooks, safe read-only tooling, and a professional reporting format. That structure is what makes AI security review actually trustworthy — it can't wander into unauthorized or offensive territory.
What it looks for
- 🔑 Exposed secrets — hardcoded keys, tokens, credentials, and endpoints
- 📦 Dependency & supply-chain risk — vulnerable or outdated packages across manifests and lockfiles
- 🛡️ Misconfigurations — security headers, cookies, CORS, CSP, TLS, redirects
- 🔐 Auth & session weaknesses — authentication and authorization flaws
- 📱 Mobile risks — dangerous permissions, exported Android components, insecure deep links, unsafe WebViews, cleartext traffic, disabled cert checks, weak ATS
- 🧩 Insecure storage & build/debug misconfiguration on client and mobile
Assessed against established baselines: OWASP Top 10, OWASP WSTG, OWASP API Security Top 10, OWASP MASVS, and Android/iOS platform best practices.
Guardrails (the part that matters)
- Authorization first. Nothing is scanned, probed, or fetched until ownership/permission and scope are confirmed.
- Static & passive by default. Reading files you were handed is fine; reaching out to a live target is active testing and requires explicit permission.
- No offensive behavior. Exploitation, brute force, credential stuffing, persistence, malware, stealth/evasion, DoS, and data exfiltration are explicitly refused — those are the villains, not the techniques.
- Minimum harmless proof. Findings are validated with the smallest safe demonstration, never a real breach.
Supported assets
| Asset type | Playbook |
|---|---|
| Website / web application | references/web-security.md |
| Frontend codebase (JS/TS, React, Vue, …) | references/frontend-code-review.md |
| Android APK / AAB / App Bundle | references/android-apk-aab.md |
| iOS IPA | references/ios-ipa.md |
| Mobile source (native or cross-platform) | references/mobile-source-review.md |
Included tooling
Safe, read-only, offline helper scripts — they parse artifacts you already have and never touch a network target:
| Script | What it does |
|---|---|
scripts/scan_secrets.py | Regex scan for key/token/credential-like strings, with line refs and redaction |
scripts/parse_android_manifest.py | Summarize permissions, exported components, deep links, debug/backup/cleartext flags |
scripts/parse_ios_plist.py | Summarize bundle metadata, ATS settings, URL schemes, permission strings |
scripts/check_dependencies.py | Parse dependency manifests/lockfiles and list declared versions for review |
scripts/format_report.py | Render findings JSON into the standard report Markdown |
Reporting
Every finding ships with severity (Critical / High / Medium / Low / Informational), confidence, affected asset, redacted evidence, impact, safe reproduction steps, and remediation. Severity is reasoned from exploitability and business impact — not keyword-matched to a vulnerability class.
Installation
This is a Claude Code Skill. Drop it into your skills directory:
git clone https://github.com/riteshksingh007/thanos-snap-security.git
# Copy into your Claude Code skills folder, e.g.:
cp -r thanos-snap-security ~/.claude/skills/
Then invoke it in Claude Code:
Review this repository for security issues — I own it and authorize a static review.
Repository structure
thanos-snap-security/
├── SKILL.md # Skill definition + workflow
├── references/ # Asset-specific security playbooks
└── scripts/ # Safe, read-only analysis helpers
⚠️ Responsible use
This skill is for authorized security work only — assets you own or have written permission to assess. Using it against systems you don't control may be illegal. The authorization gate exists for a reason; don't bypass it.
License
Built by Ritesh Singh as a Claude Code skill exploring how AI security review becomes trustworthy when it's a structured workflow with real guardrails — not just a prompt.