compound-security

Compound Security

Built by Offense Research, Inc.. Want our team to handle the audit, fixes, and security automation? Work with Offense Research.

Find a vulnerability, repair its cause, prove the fix, and retain the lesson so the next review starts with better security knowledge.

Compound Security combines Cloudflare's source-grounded security audit with Every's compound engineering loop. The reusable core is one portable skill; version 0.4.0 provides twelve focused entry points and native Claude Code and Codex manifests.

For all twelve workflows, examples, and record formats, read the full documentation.

Start here

Describe what you are building or what worries you. Start with cs-help for a recommendation, use cs-brainstorm to choose a useful security goal, and use cs-lfg to carry that goal through the available local work.

| What you have in mind | Start with | What you get |
| --- | --- | --- |
| "I don't know where to start" | cs-help | One recommended next action, a ready-to-use command, and a few alternatives |
| "We're launching a SaaS; what should we secure first?" | cs-brainstorm | Grounded options, priorities, and a scoped SECURITY-BRIEF.md |
| "Take this goal through to completion" | cs-lfg | A route from current evidence, local execution, independent verification, prevention, and honest blockers |

For example, in Claude Code:

/compound-security:cs-help We're about to launch a SaaS. Where should I start?
/compound-security:cs-brainstorm We handle customer documents and use AI agents. What should we secure first?
/compound-security:cs-lfg Take the selected tenant-isolation scope from our brief through verified local fixes and prevention.

Each is a separate invocation. Help gives guidance without creating a run. Brainstorm creates a brief without starting an audit or changing product code. Invoking LFG requests the scoped local work; it preserves any explicit restrictions such as "report only."

Use it

| Entry point | Outcome |
| --- | --- |
| compound-security | Select the appropriate mode from the user's request |
| cs-help | Explain useful starting points and recommend one next command |
| cs-brainstorm | Turn a concern or goal into grounded options and a security brief |
| cs-lfg | Choose or resume the route from current work, completing feasible local stages with bounded retries |
| cs-dependencies | Inspect dependencies, explain next actions, and generate local reports |
| cs-patch | Plan and rehearse dependency upgrades, then track rollout and recovery evidence |
| cs-audit | Inspect scoped code and report evidence-backed findings |
| cs-plan | Turn findings and prior lessons into a remediation plan |
| cs-fix | Apply selected local fixes within the authorized scope |
| cs-verify | Check the fix, regression protection, and remaining gaps |
| cs-compound | Preserve verified lessons as checks and reusable knowledge |
| cs-run | Run the explicitly requested full audit-to-compound pipeline |
| cs-status | Report coverage, findings, blockers, and next actions |

For Claude Code, use the plugin namespace:

/compound-security:cs-audit review the authentication and tenant-isolation code
/compound-security:cs-plan use the findings from that audit
/compound-security:cs-fix apply the confirmed findings' remediation plan
/compound-security:cs-verify verify those fixes
/compound-security:cs-compound retain the verified prevention lessons

For Codex, invoke plugin skills with the compound-security: prefix inside the Codex prompt. Type $compound-security: to find them in the skill picker. For example:

$compound-security:cs-help I'm new to this. Recommend a starting point for this project.
$compound-security:cs-brainstorm Help me prioritize security work before launch.
$compound-security:cs-lfg Carry the selected scope through local fixes, verification, and prevention.
$compound-security:cs-audit review the authentication and tenant-isolation code
$compound-security:cs-run audit this repository and fix confirmed findings locally
$compound-security:cs-status summarize the latest run

The core SKILL.md defines each mode, its prerequisites, and the artifact contract. Wrappers delegate to that same core rather than maintaining separate methodologies.

If only the standalone core skill is installed, use $compound-security help, $compound-security brainstorm, or $compound-security lfg with the same request. The short $compound-security:cs-* entry points belong to the plugin package.

Understand dependencies before upgrading

$compound-security:cs-dependencies Inspect this repository without changing source. Explain the next useful action, show dependency paths and coverage gaps, and generate private HTML and Markdown reports.

Claude Code uses /compound-security:cs-dependencies; the standalone core uses $compound-security dependencies. The agent reads manifests and supported owner-provided npm 11 or pnpm 10.23+ (within major 10) captures, recalls relevant lessons, and assesses actions. Bundled scripts normalize data and render reports; they do not execute package managers. Missing or unsupported evidence stays visible as a coverage gap.

DEPENDENCIES.json is the structured evidence record. The offline local report includes private details. Request a separate sharing export when needed; it masks package names by default and sends nothing. Inspection stops at recommendations. Select a repair explicitly to continue through cs-patch, which checks source freshness and retains separate security, compatibility, and deployment evidence. See the collection and report contract.

Patch a dependency

Start with one npm/pnpm package, advisory, or existing upgrade PR. In the Codex prompt:

$compound-security:cs-patch Upgrade the vulnerable dependency in this workspace. Produce a tested local patch, compatibility evidence, and a rollout/recovery plan. Do not deploy.

In Claude Code use /compound-security:cs-patch with the same request. For the standalone core use $compound-security patch.

The workflow inventories affected dependency paths, verifies primary advisory ranges, compares supported upgrade paths, records a baseline, rehearses the change, obtains independent review, and prepares recovery. Help and brainstorm now offer patching as a starting point; LFG can resume it. Existing plan/fix/verify/status/compound modes use the same lifecycle.

PATCH-PLAN.md records decisions and evidence; PATCH-STATE.json separates security, compatibility, and deployment status. A locally verified patch is not marked deployed. Production closure requires observed artifact/version coverage and health checks. A rollback reopens the work. Advisory resolution alone does not prove an application exploit or satisfy the existing audit closure contract.

This release supplies the workflow and record validation. It does not include deployment adapters, a sandbox, scanners, or continuous monitoring. Without those integrations, it delivers the feasible local work and an explicit handoff. Other package ecosystems and infrastructure need additional ecosystem-specific guidance.

Practice on three cases: a direct update, a transitive dependency needing a parent upgrade, and an upgrade that fixes the advisory but fails legitimate behavior checks. Keep failed candidates as evidence.

LFG and run

cs-run requests the full audit → plan → fix → verify → compound pipeline. cs-lfg starts from a goal, brief, existing audit, remediation plan, or unfinished patch, checks which evidence is still current, and runs the missing stages. It keeps a private checkpoint and carries retry limits forward on resume. Both honor the same evidence and execution gates. Missing capabilities produce an explicit partial result; they never become invented passing tests.

LFG handles requested local work without repeated stage-by-stage approval. Publishing, messaging, merging, deployment, paid services, or new data uploads still require their own existing authorization. Its checkpoint records progress; it is not an authorization source or an installed background runner.

Install from this package

Install directly from the public Offense Research repository. In Claude Code, run these commands one at a time:

/plugin marketplace add offense-research/compound-security-plugin
/plugin install compound-security@compound-security-plugin

For Codex CLI, run:

codex plugin marketplace add offense-research/compound-security-plugin
codex plugin add compound-security@compound-security-plugin

To install from a local checkout instead, clone the repository:

git clone https://github.com/offense-research/compound-security-plugin.git
cd compound-security-plugin
pwd

Use the absolute directory printed by pwd wherever the commands below show /absolute/path/compound-security-plugin.

Claude Code

Load the local package for the current session:

claude --plugin-dir /absolute/path/compound-security-plugin

For a persistent installation, in Claude Code:

/plugin marketplace add /absolute/path/compound-security-plugin
/plugin install compound-security@compound-security-plugin

Codex CLI

Register the local marketplace and install its plugin:

codex plugin marketplace add /absolute/path/compound-security-plugin
codex plugin add compound-security@compound-security-plugin

Local marketplace installation uses a cached copy; edits to this source directory may require reinstalling. Use a new session after installation if skills are not immediately visible. The manifests follow the native Codex layout present in the inspected Every revision; actual host loading must be checked with the installed CLI version.

Update an existing Codex installation

Version 0.4.0 adds local dependency inspection and preserves the plugin prefix in follow-up commands and brief artifacts. If an existing installation still suggests bare entry-point names, refresh its marketplace and installed copy:

codex plugin marketplace upgrade compound-security-plugin
codex plugin add compound-security@compound-security-plugin
codex plugin list

Open a new session in your coding client so it discovers the updated skills. Type $compound-security:cs-help into the Codex prompt. If the problem persists, include the output of codex --version and codex plugin list when reporting it.

Portable skill

An Agent Skills-compatible host can load skills/compound-security/ directly. If importing the cs-* entry points too, preserve the sibling layout under skills/. The core works without the wrappers. Multi-agent hosts can delegate specialist passes; a host without delegation must disclose reduced independence.

What compounds

| Inherited from | What is retained |
| --- | --- |
| Cloudflare | Deterministic coverage, independent candidate disproof, distinct confirmed/blocked/rejected verdicts, final record checks |
| Every | Recall before planning, plan/work/review/compound, executable prevention before documentation, stale-lesson refresh |
| New in this package | Immutable audit snapshot plus a separate fix lifecycle, revision-bound regression evidence, independent patch verification, sanitized security memory |

Audit evidence and reusable security knowledge serve different purposes. A candidate remains unconfirmed until its attack path is supported. A verified fix can produce a regression check or a narrowly applicable lesson. Later audits and fix plans retrieve those lessons, recheck them against current code, and use them to change what gets reviewed or tested.

An audit does not authorize product changes. Fix, run, and LFG modes apply only the requested local scope. Runtime exploit checks require the execution boundary described by the core; missing capabilities are reported as blockers. A clean scanner result alone does not prove a fix. The package has no automatic hooks, remote MCP servers, telemetry, API keys, or mandatory paid services.

Validate the package

Requires Node.js 18+ for the artifact validators/tests and Python 3.9+ for the structural checker. Independent-agent support and an appropriately controlled execution runner are needed for full runtime verification; neither is supplied by this package.

python3 scripts/validate_plugin.py
node --test skills/compound-security/references/audit/validate-findings.test.cjs skills/compound-security/references/audit/validate-coverage-ledger.test.cjs skills/compound-security/scripts/*.test.cjs

This checks manifest consistency, the core and wrapper layout, relative wrapper links, and provenance notices. It does not execute target code or prove that Claude Code or Codex can load the plugin. Follow the core's own artifact validation and verification instructions during actual reviews.

The Node suites test the bundled record validators, including rejection of stale/self-reviewed closure and unconfirmed findings. They are not target application tests. Neither native host CLI was available in the authoring environment, so actual Claude/Codex loading has not been smoke-tested.

Records

SECURITY-BRIEF.md holds brainstorm scope and success criteria. LFG-STATE.json records an LFG goal, progress, source identities, consumed retries, and blockers for safe resumption. Help creates neither file.

Keep raw audit artifacts outside tracked source. findings.json and coverage-ledger.json retain the audited revision; closure.json tracks planned, fixed-unverified, verified, compounded, or deferred work by fingerprint. RECALL.md records which prior lessons changed the work. Sanitized lessons default to docs/solutions/security/; the regression test/rule is the durable prevention artifact.

The complete shape reference is closure.example.json, with fictional data clearly identified by the contract. Never use example results as execution evidence.

Work with Offense Research

We do this work as a service. Offense Research, Inc. helps teams audit their systems, implement fixes, and set up agents that keep security work moving.

• Code and infrastructure audits to identify exposed boundaries, verify findings, and prioritize the work.
• Dependency and infrastructure upgrades with compatibility planning, testing, and a clear rollout path.
• Security remediation with regression tests and verification of the fixes.
• Security agents and CI workflows that turn repeatable checks and upgrade work into part of your development process.

Bring us a repository, an upgrade backlog, or a security concern. We'll help scope the work and carry it through. Talk to Offense Research, Inc.

Attribution

Copyright 2026 Offense Research, Inc. Original Compound Security work is licensed under Apache-2.0. Bundled upstream material retains its MIT notices. See LICENSE, THIRD_PARTY_NOTICES.md, and sources.lock.json for retained notices and exact upstream revisions.

Hermes Agent

This repository includes an Agent Plugins v1 portable package. Catalog admission is pending; it is not currently an official or verified Hermes listing.

hermes plugins install offense-research/compound-security-plugin --no-enable
hermes plugins enable compound-security

These commands require a published revision containing the root plugin.json. For local validation before publication:

hermes plugins validate /absolute/path/to/compound-security-plugin --install-deps

Ask Hermes to load compound-security:cs-help through skill_view to choose a starting point. Skills are discovered through skills_list; use the names Hermes actually registers. Do not use Codex dollar-prefixed commands in Hermes.

Permissions and behavior disclosure

The package supplies instructions and reviewable helper scripts, with no startup hooks, MCP servers, background services, telemetry, credential storage, self-updater, or Python dependencies. Enabling it makes its security workflow instructions available to the agent.

When invoked, workflows read the authorized target repository and may write project instructions, reports, checkpoints, tests, and requested fixes outside the plugin directory. Helpers run shell commands through host tooling and require Node.js for JavaScript validators. Dependency checks and optional connected services can make network requests; private-code uploads or new service connections require user authorization. Existing host approvals remain in effect. Credentials must use Hermes-managed routes; do not read credential stores or bypass host approvals. Availability of scanners, sandboxing, delegation, and connected services is checked at runtime; installation does not provision them.

README from the reviewed commit 0229f78; it updates when the author re-pins.