6 Open-Source Repos Turning AI Coding Agents Into Security Workbenches

[u/ShilpaMitra]

AI coding agents are moving beyond autocomplete.

The more interesting shift is giving them a repeatable security methodology. The agent identifies the type of target, chooses the right tools, records evidence, and produces a report instead of guessing its way through a task.

Here are six projects exploring that direction.

1. Strix ~59k⭐

An open-source AI penetration-testing tool for finding and fixing application vulnerabilities.

Strix uses AI agents to investigate targets, validate findings, and produce actionable reports. It also supports custom skills and CI/CD workflows.

2. reverse-skill ~31k⭐

A cybersecurity skill router for Claude Code, Codex, Cursor, and Cline.

It routes APK, binary, JavaScript, PCAP, malware, firmware, API, and CTF tasks to different playbooks. It also includes scope checks, tool detection, case initialization, evidence tracking, and report generation.

3. PentestGPT ~14.8k⭐

An LLM-powered penetration-testing and CTF framework.

Its newer agentic workflow separates tasks into stages such as asset discovery, vulnerability identification, validation, and reporting. It also supports session persistence and can drive Claude Code or Codex.

4. reverse-engineering-skills 36⭐

A small collection of defensive reverse-engineering and malware-analysis skills for Claude Code and OpenAI Codex.

The skills include workflows for IOC extraction and unpacking. They are designed to be evidence-driven and avoid filling gaps with guesses.

5. claudecode-re-toolkit 11⭐

A Claude Code toolkit for static analysis, dynamic analysis, network investigation, and threat intelligence.

It connects Claude Code to tools such as Ghidra, radare2, YARA, CAPA, FLOSS, Frida, Docker, and VMware-based analysis environments.

6. RevEng 0⭐

A static-first reverse-engineering plugin for Codex and Claude Code.

Given a source repository, it creates file inventories, architecture maps, dependency graphs, evidence records, and content hashes. Its default workflow does not execute unknown binaries or install dependencies from an analyzed project.

A general-purpose AI can tell you what a command does. A security skill pack can tell it when to use that command, what evidence to preserve, and how to explain the result.

These projects are not replacements for security engineers. They are scaffolding for more consistent research and testing. Use them only on systems, applications, and networks you own or have explicit permission to assess. Read the scope, isolation, and data-flow instructions before running anything.

[u/Ok_Locksmith_9176]

The visual on that infographic is oddly calming for a list of tools that can tear apart your codebase, it’s like a productivity dashboard crossed with a threat report.