# agricidaniel/claude-cybersecurity architecture

> Architecture diagram of the GitHub repository agricidaniel/claude-cybersecurity, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/agricidaniel/claude-cybersecurity
- Repository: https://github.com/agricidaniel/claude-cybersecurity

## Overview

claude-cybersecurity is a Claude Code security-audit skill, not a standalone scanning service. A user invokes the skill against a project, selects a full, quick, diff, or focused audit, and the documented orchestrator coordinates eight specialist agents across security dimensions. The repository also supplies reference knowledge for vulnerability classes, language and IaC patterns, threat intelligence, scoring, compliance, suppression, and report formatting. The README documents these capabilities and the orchestrator’s role; no source excerpts were provided, so implementation-level calls and agent-to-reference links are not asserted.

Main entry points: [`skills/cybersecurity/SKILL.md`](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md) (Audit orchestrator), [`skills/cybersecurity/references/vulnerability-taxonomy.md`](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/vulnerability-taxonomy.md) (Vulnerability review), [`skills/cybersecurity/references/iac-patterns`](https://github.com/agricidaniel/claude-cybersecurity/tree/main/skills/cybersecurity/references/iac-patterns) (IaC security), [`skills/cybersecurity/references/threat-intelligence.md`](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/threat-intelligence.md) (Threat intelligence)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workflow["Audit workflow"]
  node_skill["Audit orchestrator<br/>[SKILL.md]"]
end

subgraph group_analysis["Security analysis"]
  node_agents["Specialist agents<br/>[SKILL.md]"]
  node_vulnerability["Vulnerability review"]
  node_authorization["Authorization review<br/>[SKILL.md]"]
  node_secret_supply["Secrets and supply chain<br/>[SKILL.md]"]
  node_iac["IaC security"]
  node_threat["Threat intelligence"]
  node_ai_logic["AI code and logic<br/>[SKILL.md]"]
end

subgraph group_knowledge["Reference knowledge"]
  node_language_patterns["Language patterns"]
  node_semgrep["Semgrep patterns"]
  node_compliance["Compliance mapping"]
  node_suppression["False-positive rules"]
end

subgraph group_results["Assessment results"]
  node_scoring["Finding scoring<br/>[scoring-rubric.md]"]
  node_report["Audit report<br/>[report-template.md]"]
end

node_user(("Auditor"))
node_project["Project codebase"]

node_user -->|"invokes"| node_skill
node_skill -->|"audits"| node_project
node_skill -->|"spawns eight"| node_agents
node_agents -->|"reviews flaws"| node_vulnerability
node_agents -->|"checks controls"| node_authorization
node_agents -->|"reviews exposure"| node_secret_supply
node_agents -->|"scans IaC"| node_iac
node_agents -->|"checks threats"| node_threat
node_agents -->|"reviews patterns"| node_ai_logic
node_skill -.->|"uses patterns"| node_language_patterns
node_skill -.->|"uses patterns"| node_semgrep
node_skill -->|"maps compliance"| node_compliance
node_skill -->|"suppresses false positives"| node_suppression
node_skill -->|"scores findings"| node_scoring
node_skill -.->|"formats report"| node_report

click node_skill "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md"
click node_agents "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md"
click node_vulnerability "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/vulnerability-taxonomy.md"
click node_authorization "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md"
click node_secret_supply "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md"
click node_iac "https://github.com/agricidaniel/claude-cybersecurity/tree/main/skills/cybersecurity/references/iac-patterns"
click node_threat "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/threat-intelligence.md"
click node_ai_logic "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md"
click node_language_patterns "https://github.com/agricidaniel/claude-cybersecurity/tree/main/skills/cybersecurity/references/language-patterns"
click node_semgrep "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/semgrep-patterns.md"
click node_compliance "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/compliance-matrix.md"
click node_suppression "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/false-positive-suppression.md"
click node_scoring "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/scoring-rubric.md"
click node_report "https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/report-template.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_skill toneBlue
class node_agents,node_vulnerability,node_authorization,node_secret_supply,node_iac,node_threat,node_ai_logic toneAmber
class node_language_patterns,node_semgrep,node_compliance,node_suppression toneMint
class node_scoring,node_report toneRose
class node_user,node_project toneIndigo
```

## Components

### Audit workflow

- [Audit orchestrator](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md): `skills/cybersecurity/SKILL.md`

### Security analysis

- [Specialist agents](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md): `skills/cybersecurity/SKILL.md`
- [Vulnerability review](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/vulnerability-taxonomy.md): `skills/cybersecurity/references/vulnerability-taxonomy.md`
- [Authorization review](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md): `skills/cybersecurity/SKILL.md`
- [Secrets and supply chain](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md): `skills/cybersecurity/SKILL.md`
- [IaC security](https://github.com/agricidaniel/claude-cybersecurity/tree/main/skills/cybersecurity/references/iac-patterns): `skills/cybersecurity/references/iac-patterns`
- [Threat intelligence](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/threat-intelligence.md): `skills/cybersecurity/references/threat-intelligence.md`
- [AI code and logic](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/SKILL.md): `skills/cybersecurity/SKILL.md`

### Reference knowledge

- [Language patterns](https://github.com/agricidaniel/claude-cybersecurity/tree/main/skills/cybersecurity/references/language-patterns): `skills/cybersecurity/references/language-patterns`
- [Semgrep patterns](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/semgrep-patterns.md): `skills/cybersecurity/references/semgrep-patterns.md`
- [Compliance mapping](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/compliance-matrix.md): `skills/cybersecurity/references/compliance-matrix.md`
- [False-positive rules](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/false-positive-suppression.md): `skills/cybersecurity/references/false-positive-suppression.md`

### Assessment results

- [Finding scoring](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/scoring-rubric.md): `skills/cybersecurity/references/scoring-rubric.md`
- [Audit report](https://github.com/agricidaniel/claude-cybersecurity/blob/main/skills/cybersecurity/references/report-template.md): `skills/cybersecurity/references/report-template.md`

### Other components

- **Auditor**
- **Project codebase**

## Connections

- Auditor → Audit orchestrator: invokes (evidence: `README.md`)
- Audit orchestrator → Project codebase: audits (evidence: `README.md`)
- Audit orchestrator → Specialist agents: spawns eight (evidence: `README.md`)
- Specialist agents → Vulnerability review: reviews flaws (evidence: `README.md`)
- Specialist agents → Authorization review: checks controls (evidence: `README.md`)
- Specialist agents → Secrets and supply chain: reviews exposure (evidence: `README.md`)
- Specialist agents → IaC security: scans IaC (evidence: `README.md`)
- Specialist agents → Threat intelligence: checks threats (evidence: `README.md`)
- Specialist agents → AI code and logic: reviews patterns (evidence: `README.md`)
- Audit orchestrator → Language patterns: uses patterns
- Audit orchestrator → Semgrep patterns: uses patterns
- Audit orchestrator → Compliance mapping: maps compliance (evidence: `README.md`)
- Audit orchestrator → False-positive rules: suppresses false positives (evidence: `README.md`)
- Audit orchestrator → Finding scoring: scores findings (evidence: `README.md`)
- Audit orchestrator → Audit report: formats report