# Sechelix

> Run SecHelix evidence-first application-security audits on authorized repositories and environments. Use for codebase, API, web, auth/authz, business-logic, payment, race-condition, supply-chain, AI/MCP, cloud, and release-security review.

- Skill: `omarmohelal/sechelix-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add omarmohelal/sechelix-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/omarmohelal/sechelix-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: omarmohelal (https://skillmd.com/u/omarmohelal)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/omarmohelal/sechelix-3

---


# SecHelix for Claude Code

Read and follow `skills/sechelix/SKILL.md` as the canonical workflow. Use the project-local supporting resources under `catalog/`, `references/`, `agents/`, `examples/`, and `scripts/`.

Claude-specific orchestration guidance:

- Use subagents only for disjoint review lanes.
- Give each implementation/fix agent isolated ownership; do not let audit agents mutate the same release tree concurrently.
- Focused tests per lane; centralized heavy verification after integration.
- For High/Critical candidates, spawn an independent verifier that is asked to refute the finding rather than confirm it.
- Do not let dynamic testing leave authorized local/staging scope unless the operator explicitly authorizes a bounded production-safe check.

The methodology, severity rules, safety policy, and evidence standard are defined only in the canonical `skills/sechelix/SKILL.md`; do not fork them here.