Q16GCommunity·51 Agent Skills Included

aster

Automated code audits, penetration testing, and host defense

Runs security code audits, black-box penetration tests, CTF solving, and host intrusion analysis from the terminal. Covers SAST scanning, dataflow tracing, dependency CVE checks, SQLi/XSS/SSRF/IDOR testing, and log-based threat hunting. Eliminates manual payload crafting and repetitive checklist work with 54+ ready security workflows and structured evidence reports.

83|8

↗

npx skills add Q16G/aster --all -g -y

All Skills in This Repository (51)

Pure Emerald Level Indicators

📦 In Repo

Q16G

vuln-reproduction

Normalize vulnerability findings into standardized reproduction tasks with traceable evidence chains.

dataflow-analysis

Analyze cross-function taint propagation with SyntaxFlow MCP and deterministic fallback.

security-header-audit

Detect missing or misconfigured HTTP security headers and cookie attributes.

project-framework-analysis

Map technology stacks, architecture layers, and entry points into a project-framework diagram.

dependency-decompile

Recover readable source code for critical-path dependencies lacking source.

sast-scan

Scan multi-language codebases with local Semgrep rules for security weaknesses.

session-security

Audit session management for weak IDs, fixation risks, and cookie misconfigurations.

dependency-audit

Scan project manifests and lockfiles to identify known CVEs.

stored-xss-detection

Trace storage XSS risk chains from source to render sinks.

business-logic-auth-review

Audit authentication and authorization weaknesses across Java, PHP, Python, and Go codebases.

client-js-audit

Audit client-side JavaScript for DOM XSS and token handling risks.

secret-detection

Detect hard-coded secrets in code repositories and generate remediation guidance.

Community

Intermediate

Frequently Asked Questions

FAQPage Schema

How to install aster?▼

Run `npx skills add Q16G/aster --all -g -y` in your terminal to install all skills in this suite globally.

What security tasks can aster automate?▼

It covers white-box code auditing (SAST, dataflow tracing, secrets, configs), black-box penetration testing (SQLi, XSS, SSRF, IDOR, CSRF), Web CTF solving, and host-defense tasks like log analysis and malware detection.

Which models and providers does aster support?▼

It works with OpenAI, Anthropic, DeepSeek, Groq, OpenRouter, Together, and local Ollama models, plus 128+ providers via the built-in models.dev registry.

Does aster need online services to scan code?▼

No. It ships with local Semgrep rule sets for Go, Java, Python, JS, PHP, and C, so static analysis runs fully offline with zero online dependencies.

Can non-developers use aster for security testing?▼

Yes. You describe the target in plain language and the agent plans, executes, and verifies each test, then produces a structured evidence-backed report.