🕵️ paranoid

Your app is guilty until proven secure. /hack-me breaks into your own running app, proves each hole with a real request, patches it, and re-verifies — on localhost, with receipts.

paranoid is an agent skill for Claude Code, Codex, and Cursor. Its core is /hack-me — an authorized, localhost-only self-pentest loop that attacks your own app the way an attacker would, then closes what it finds.

find  →  prove  →  patch  →  re-verify

Why this isn't another "write secure code" skill

I started with the obvious thing — a skill that tells the agent to write secure code — and then benchmarked it honestly before believing in it. The harness (benchmark/) generates the same tasks with and without the skill and runs real exploits against whatever the model writes.

The result was a clean negative:

On an isolated function, a capable model already writes the secure version unprompted — ownership in the WHERE clause, parameterized queries, field allow-lists — with no skill at all. Advice adds nothing there. (The harness isn't rigged: it flags deliberately-insecure reference code at 100% and secure code at 0%.)

Real vulnerabilities don't live in one tidy function. They live in the wiring of a whole running app: auth on one route but not the next, a request body that quietly sets is_admin, a search box that concatenates SQL. A model can't hold all of that in its head while coding. So paranoid stops advising and starts attacking the running app.

/hack-me, proven

Against a small but realistic invoicing API (examples/ledgerlite), a hack-me agent that was told nothing about the app's bugs found four by probing, proved each with a live request, patched them, and re-verified:

Every legitimate request still returns 200 after the fixes. The full walkthrough — exact exploit requests, responses, diffs, and re-verification — is in examples/ledgerlite/HACKME_REPORT.md. Reproduce it: python3 examples/ledgerlite/app.py, then run /hack-me.

That target was written as a demo, so it proves the loop works end-to-end. Point /hack-me at your app for your own results.

Proven on an app we didn't write

The harder claim is code we don't control. Pointed at OWASP VAmPI — a well-known third-party vulnerable API — with nothing but its URL, /hack-me found, proved, patched and re-verified six real bugs, including SQL-injecting the admin's password out through the API and an unauthenticated endpoint dumping every user's plaintext password:

Notably, VAmPI's own global "secure mode" flag closed only four of the six — the critical password dump stayed open until patched. /hack-me caught it by replaying every exploit instead of trusting the flag. Full receipts: examples/vampi/HACKME_REPORT.md.

What /hack-me actually does

1. Maps your running app and picks the risk classes it's exposed to.
2. Probes for each — one crafted request that only succeeds if the bug is real.
3. Proves every finding with the actual request/response (no theorizing).
4. Patches the root cause with a minimal, behavior-preserving fix.
5. Re-verifies by replaying the exact exploit — a finding isn't closed until it fails.

Guardrails, always: your own / authorized targets, localhost only, non-destructive proofs. It won't touch third-party hosts, evade detection, or build live malware. See commands/hack-me.md.

Install

npx skills add kulchankas/paranoid/skills/paranoid

Then copy commands/hack-me.md into your agent's commands dir (e.g. .claude/commands/) so /hack-me is available. No dependencies, no network calls, no telemetry — it's Markdown your agent reads.

python3 my_app.py            # start your app locally
/hack-me                     # point the agent at http://localhost:<port>

Also inside: the paranoid skill (secure-by-default companion)

The guidance the benchmark tested still earns its place as a companion while you code and as hack-me's knowledge base — concrete failure modes and fixes for the vulnerability classes that actually ship in vibe-coded apps:

• the vibe-coded top 10
• references: auth & access · secrets & the client boundary · injection & SSRF · APIs & webhooks · /hack-me framework guides
• a 7-point pre-commit gate

Load it while building; run /hack-me to check whether it held.

The benchmark

An honest, reproducible harness for the question "does a security skill actually reduce vulnerabilities?" — plus the negative result above and how to re-run it: benchmark/.

Scope & ethics

paranoid secures your code and pentests your running app, with your say-so. It is not built to target third-party systems, scan hosts you don't own, evade detection, or produce live malware, and it will decline to. Authorized, defensive, local.

Roadmap

• /hack-me loop — find → prove → patch → re-verify, on localhost
• Reproducible skill-efficacy benchmark + the honest result behind the pivot
• Independent-app proof — OWASP VAmPI: 6 real bugs found, fixed & re-verified
• More benchmark task classes — 18 now (IDOR, missing auth, SQLi, mass assignment, path traversal, SSRF, XSS, command injection, open redirect, JWT auth, leaked secrets, CSRF, template injection, XXE, unrestricted upload, permissive CORS, weak password storage)
• /hack-me framework guides (Next.js, FastAPI, Express)

paranoid is v0.1 and actively developed — issues and PRs welcome.

Contributing

New vulnerability classes, framework guides, and independent-app proofs are the most useful contributions — see CONTRIBUTING.md for the format and the honesty rules, and SECURITY.md for scope. Good first issues are labeled in the tracker.

License

MIT © 2026 kulchankas. See LICENSE.