# paranoid

An agent skill that pentests your own running application: it finds a vulnerability, proves it with a real HTTP request, patches it, then re-verifies the fix.

paranoid is an agent skill for Claude Code, Codex and Cursor that attacks a running application the way an attacker would, following a find, prove, patch and re-verify loop. Nothing is reported as a bug until a real HTTP request demonstrates it, no fix counts as done until that exact exploit stops working, and a vulnerability class is not closed until the same pattern is checked across paths the first probe did not reach.

It installs as a Claude Code plugin skill, or as a markdown command file for any other agent that reads skills, and needs no external dependencies, network calls or telemetry. Its documented runs include finding and patching issues such as authentication bypass, broken object-level authorization, privilege escalation and SQL injection in third-party test applications.

Website: https://github.com/kulchankas/paranoid