More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsBreachguard
Run an authorized security review of an app you own: map the attack surface, check auth, RLS and IDOR, secrets and dependencies, then hand back a fix-first report with a retest for every finding.
$19
Breachguard
Example session with this skill installed
Perform a security review of our Supabase app. We have written permission to test the staging branch. Check RLS policies and API route protection.
- Read your context and instructions
- Compiled the breachguard
- Generated the document
Authorization confirmed: staging branch only, written permission on file, production data out of bounds. I mapped the attack surface from the repo (12 tables, 8 API routes) and ran the review on the staging copy. Findings are ranked by severity; each has a fix and a retest that proves it closed.
| Severity | Finding | Where | Fix | Retest (after the fix) |
|---|---|---|---|---|
| Critical | Row-level security not enabled on one table | db/schema.sql | alter table profiles enable row level security; plus an owner-scoped policy | Confirm the table now has RLS on and a policy; a non-owner read returns no rows |
| High | A record route trusts the id without an ownership check | /api/orders/[id] | Scope the query to the signed-in user (.eq('user_id', auth.uid())) | Confirm a low-privilege account can no longer read another account's record (403, not 200) |
| Medium | Password reset confirms whether an email exists | /auth/reset | Return the same "if an account exists, an email was sent" either way | Confirm both a real and an unknown email return the identical response |
| Low | HSTS header missing | next.config.js | Add Strict-Transport-Security to the headers | curl -I the staging URL and confirm the header is present |
Each fix was verified on staging, not production. Nothing in this report contains real user data.
Next steps
- Apply the critical and high fixes first; they are the two that expose data.
- Rerun each retest in the table and mark the finding closed with the date.
- Keep the checklist and rerun it before the next release.
breachguard.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
About this skill
Most apps ship with a quiet hole: one table with row-level security off, an API route the UI hides but the server leaves open, a service key in the bundle. Ask your agent to "run a security review" and Breachguard confirms the scope first, maps the attack surface from your code, checks the classes that actually get exploited, verifies each finding safely on a copy, and writes a report where every issue has a concrete fix and a retest.
Why it's different
- Permission-gated: it reviews only what you own or have written authorization to test. No scope, no review.
- Finds what gets exploited: row-level security and IDOR, auth gaps, secrets in the bundle, not a generic checklist.
- Safe verification: each finding is proven with the smallest safe step on a staging or local copy, never a destructive or bulk action.
- Fix-first: every finding has a severity, a plain-words impact, the concrete fix, and a retest that proves it closed.
What it does
- Authorization and scope: who owns it, who signed off, what is in and out of bounds, recorded in the report header.
- Attack surface map: routes, roles, tables and their access rules, uploads, webhooks, jobs and third-party keys, read from the repo.
- The core classes: authentication and session, authorization with RLS and IDOR, input handling, secrets and config, dependencies.
- Safe proof: reproduce on a copy with one request or one screenshot; unsafe-to-confirm stays "likely, unverified".
- Report and retest: severity-ranked, fix per finding, a summary the owner can read, and a checklist the team reruns.
How it works
- Authorization gate: written scope before anything runs.
- Map the attack surface from the code.
- Check the classes: auth, RLS/IDOR, input, secrets, dependencies.
- Verify safely on staging or local.
- Report fix-first, then retest and lock.
Frameworks & tools
Works with any web stack. Reads Supabase or Postgres RLS policies, Next.js or other route handlers, and runs the ecosystem audit (npm, pip, composer). Uses your repo, a staging or local copy, and curl or a browser for safe checks.
Use cases
- A pre-launch security pass on your own app.
- A periodic review of a system you run.
- A row-level security pass on Supabase or Postgres.
- An API route audit: which routes require which role, and whether the server enforces it.
Known limitations
It reviews systems you own or are authorized to test, and stops at the written scope. It is not for testing anyone else's systems, denial of service, or evading monitoring. It finds and fixes; exploitation tooling is out of scope.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 3 days ago
- Passed all security checks, Safe to install