omarmohelal/sechelix

v4.0.0-alpha.7Apache-2.0

Evidence-first application-security Agent Skill for repositories and environments you are authorized to test. Maps the attack surface, selects applicable security hypotheses from a 546-item catalog, hunts in parallel across specialist roles, then sends every candidate to an independent verifier whose job is to disprove it. Applicability resolves to APPLICABLE, NOT_APPLICABLE, UNKNOWN or BLOCKED so missing evidence is never read as absence; High and Critical findings require regression proof; and the release gate is fail-closed, returning PASS, PASS_WITH_KNOWN_RISK, BLOCKED or INCOMPLETE. Includes an UNTRUSTED_REPO mode that treats repository content as data and never as control instructions.

GitHub Open Website

sechelix

Evidence-first application-security audit workflow for authorized repositories and environments. Use when reviewing a codebase, pull request, API, web application, AI-generated code, agent or MCP integration, cloud configuration, authorization (BOLA, IDOR, BFLA), business logic, payments, race conditions, secrets, supply chain, or release readiness for security weaknesses. Also supports explicitly requested technical SEO audits and evidence-backed codebase cleanup. Maps trust boundaries, selects applicable checks, runs parallel specialist review, independently verifies every material finding and refutes false positives, fixes root causes, and requires regression proof before reporting High or Critical issues.