@lhi/tdd-audit

Security skill installer for Claude Code, Gemini CLI, Cursor, Codex, and OpenCode. Patches vulnerabilities using a Red-Green-Refactor exploit-test protocol — you prove the hole exists, apply the fix, and prove it's closed.

What happens on install

Running the installer does five things immediately:

1. Scans your codebase for 29 vulnerability patterns (SQL injection, IDOR, XSS, command injection, path traversal, broken auth, JWT alg:none, ReDoS, timing-unsafe comparisons, and more) and prints findings to stdout
2. Scaffolds __tests__/security/ with a framework-matched boilerplate exploit test
3. Adds test:security to your package.json scripts (Node.js projects)
4. Creates .github/workflows/security-tests.yml so the CI gate exists from day one
5. Installs the /tdd-audit skill for your AI coding agent

Installation

npx @lhi/tdd-audit

Or clone and run directly:

node index.js

Platform-specific flags

| Platform | Command | |---|---| | Claude Code | npx @lhi/tdd-audit --local --claude | | Gemini CLI / Codex / OpenCode | npx @lhi/tdd-audit --local | | With pre-commit hook | add --with-hooks | | Scan only (no install) | npx @lhi/tdd-audit --scan-only |

All flags

| Flag | Description | |---|---| | --local | Install skill files to the current project directory instead of ~ | | --claude | Use .claude/ instead of .agents/ as the skill directory | | --with-hooks | Install a pre-commit hook that blocks commits if security tests fail | | --skip-scan | Skip the automatic vulnerability scan on install | | --scan-only | Run the vulnerability scan without installing anything |

Framework Detection

The installer automatically detects your project's test framework and scaffolds the right boilerplate:

| Detected | Boilerplate | test:security command | |---|---|---| | jest / supertest | sample.exploit.test.js | jest --testPathPattern=__tests__/security | | vitest | sample.exploit.test.vitest.js | vitest run __tests__/security | | mocha | sample.exploit.test.js | mocha '__tests__/security/**/*.spec.js' | | pytest.ini / pyproject.toml | sample.exploit.test.pytest.py | pytest tests/security/ -v | | go.mod | sample.exploit.test.go | go test ./security/... -v | | pubspec.yaml | sample_exploit_test.dart | flutter test test/security/ |

Usage

Once installed, trigger the autonomous audit in your agent:

/tdd-audit

The agent will:

1. Scan the codebase and present a severity-ranked findings report (CRITICAL / HIGH / MEDIUM / LOW)
2. Wait for your confirmation before making any changes
3. For each confirmed vulnerability, apply the full Red-Green-Refactor loop:
   • Red — write an exploit test that fails, proving the vulnerability exists
   • Green — apply the targeted patch, making the test pass
   • Refactor — run the full suite to confirm no regressions
4. Deliver a final Remediation Summary table

The agent works one vulnerability at a time and does not advance until the current one is fully proven closed.

Vulnerability Scanner

The built-in scanner catches 29 patterns across OWASP Top 10 + mobile + agentic AI stacks:

| Category | Patterns | |---|---| | Injection | SQL Injection, Command Injection, NoSQL Injection, Template Injection, LDAP | | Broken Auth | JWT alg:none, Broken Auth, Timing-Unsafe Comparison, Hardcoded Secret, Secret Fallback | | XSS / Output | XSS, eval() Injection, Open Redirect | | Crypto | Weak Crypto (MD5/SHA1), Insecure Random, TLS Bypass | | Server-side | SSRF, Path Traversal, XXE, Insecure Deserialization | | Assignment | Mass Assignment, Prototype Pollution | | Mobile | Sensitive Storage, WebView JS Bridge, Deep Link Injection, Android Debuggable | | Config | CORS Wildcard, Cleartext Traffic, Config Secrets | | New (v1.5) | JWT Alg None, Timing-Unsafe Comparison, ReDoS |

Running security tests manually

# Node.js
npm run test:security

# Python
pytest tests/security/ -v

# Go
go test ./security/... -v

CI/CD

The installer creates .github/workflows/security-tests.yml for your stack. It runs on every pull request targeting main — any exploit test that regresses will block the merge.

To add this gate to an existing CI pipeline manually:

- name: Run security exploit tests
  run: npm run test:security   # or pytest tests/security/, or go test ./security/...

Pre-commit Hook

The --with-hooks flag appends a security gate to .git/hooks/pre-commit. Commits are blocked if any exploit test fails:

❌ Security tests failed. Commit blocked.

The hook is non-destructive — it appends to any existing hook content rather than overwriting it.

License

MIT