🛡️ CyberSecurity Superpowers

The Ultimate Enterprise DevSecOps & Cybersecurity Extension for AI Coding Agents. Embed automated threat modeling, secure coding, SAST scanning, red-team penetration testing, NIST incident response, and supply-chain security into any agentic workflow.

⚡ Why CyberSecurity Superpowers is THE Go-To Skill Set

AI coding assistants are faster than ever at writing code — but speed without security creates vulnerabilities at scale. CyberSecurity Superpowers transforms any AI assistant (Claude Code, Gemini CLI, Cursor, OpenCode, Copilot) into an autonomous CISO-grade DevSecOps engineer.

🌟 Key Differentiators & Benefits

• 🎯 360° SDLC Security Coverage: From pre-code threat modeling to post-breach incident playbooks, cover every phase of security automatically.
• 🤖 Autonomous ReAct Orchestrator: Intelligently routes tasks to specific security skill modules without manual intervention.
• 🏆 Industry-Standard Alignment: Native integration with OWASP Top 10, OWASP WSTG, MITRE ATT&CK, NIST SP 800-61, CVSS v3.1, and CycloneDX/SPDX.
• 🌐 Harness-Agnostic & Zero Lock-in: Works out of the box with any LLM, CLI, or agent runtime on Linux, macOS, and Windows.
• 📊 Audit-Ready Artifact Generation: Automatically generates structured, version-controlled Markdown & JSON reports in artifacts/reports/.

🚀 Quickstart

Get up and running in 30 seconds. Choose your install method:

📦 One-Click Install (curl | bash)

curl -sSL https://raw.githubusercontent.com/rohit-barui/CyberSecurity-Superpowers/main/install.sh | bash
cybersec demo

🐍 PyPI (pip / pipx)

pipx install cybersec-superpowers
# or: pip install --user cybersec-superpowers
cybersec threat-model "My App"

📁 Git Clone

git clone https://github.com/rohit-barui/CyberSecurity-Superpowers.git
cd CyberSecurity-Superpowers
bash scripts/setup.sh
bash examples/demo-project/run-demo.sh

🧩 The 6 Core Cybersecurity Superpowers

🏗️ Architecture & Orchestration

The system utilizes an autonomous ReAct Orchestrator (scripts/run-orchestrator.sh) that accepts natural language intent or CLI modes and routes them across the underlying security modules:

                  ┌───────────────────────────────┐
                  │    User / AI Agent Intent     │
                  └───────────────┬───────────────┘
                                  │
                                  ▼
                  ┌───────────────────────────────┐
                  │      ReAct Orchestrator       │
                  │   (scripts/run-orchestrator)  │
                  └───────────────┬───────────────┘
                                  │
      ┌───────────────┬───────────┼───────────┬───────────────┐
      ▼               ▼           ▼           ▼               ▼
┌───────────┐   ┌───────────┐ ┌───────────┐ ┌───────────┐   ┌───────────┐
│  Threat   │   │  Secure   │ │  Static   │ │   Pentest │   │ Incident  │
│ Modeling  │   │  Coding   │ │ Analysis  │ │   Plan    │   │ Response  │
└─────┬─────┘   └─────┬─────┘ └─────┬─────┘ └─────┬─────┘   └─────┬─────┘
      │               │           │           │               │
      └───────────────┴───────────┼───────────┴───────────────┘
                                  │
                                  ▼
                  ┌───────────────────────────────┐
                  │ Audit-Ready Markdown & JSON   │
                  │ (artifacts/reports/*.md)      │
                  └───────────────────────────────┘

💻 Usage & CLI Examples

Automated Orchestration

# Run Secure Coding + SAST on current codebase
bash scripts/run-orchestrator.sh implement "Authentication microservice"

# Generate complete Threat Model for a project
bash scripts/run-orchestrator.sh threat-model "Payment Gateway API"

# Run full 5-phase security suite
bash scripts/run-orchestrator.sh full "Production Release Candidate"

Direct Skill Execution

# Threat Modeling
bash skills/cybersecurity/threat-modeling/run.sh --project "E-Commerce System"

# Secure Coding Checklists
bash skills/cybersecurity/secure-coding/run.sh --language python --target-dir ./src

# Static Analysis (SAST)
bash skills/cybersecurity/static-analysis/run.sh --target-dir ./src --format md

# Penetration Testing Plan
bash skills/cybersecurity/penetration-testing/run.sh --target-app "Portal API" --scope web

# Incident Response Playbook
bash skills/cybersecurity/incident-response/run.sh --incident-type ransomware

# Supply Chain SBOM Generation
bash scripts/generate-sbom.sh --target-dir .

Git Hooks & DevSecOps Automation

Protect your main branch automatically before commits and pushes:

# Install automated Git hooks (Pre-commit SAST & Pre-push security gates)
bash scripts/init-project.sh

🛡️ CI/CD Pipeline

Every commit and pull request is automatically validated by GitHub Actions (.github/workflows/ci.yml):

• ✅ Lint & Frontmatter Validation: ShellCheck, Yamllint, and SKILL.md spec validation.
• ✅ Automated Skill Tests: End-to-end unit test execution across all 6 superpowers (tests/run-skill-tests.sh).
• ✅ Orchestrator Verification: Live execution check of the orchestrator pipeline.
• ✅ Security Gate Build: Summary matrix validation with non-zero exit enforcement on failure.

👥 Contributing

We welcome community contributions! Check out our Good First Issues and review CONTRIBUTING.md to get started.

📄 License

This project is licensed under the MIT License. Feel free to use, adapt, and build upon it!

Built with ❤️ for the AI Security & DevSecOps Community.