quickstart
The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…", or just "/quickstart" to get oriented.
- Installs
- 1.1K
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/anthropics/defending-code-reference-harness --skill quickstart- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads quickstart automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
/quickstart
Two modes, picked by whether $ARGUMENTS is empty.
- Empty → Intro mode. Short orientation, then offer the guided first run.
- Non-empty → Help mode. Treat
$ARGUMENTSas the operator's question.
Intro mode
Keep it short and a little warm; this is the first thing a new operator sees.
Say roughly:
Welcome! This repo takes you from finding your first vulnerability to patching at scale, using a set of Claude Code skills and an autonomous pipeline. Two ways in: interactive skills (no setup, safe, start here) and the autonomous pipeline (Docker, scales to hundreds of parallel agents).
The ramp-up:
| Day 1 | Threat-model + first static scan + triage | | Day 2 | Run the reference pipeline (C/C++) | | Day 3-4 | Customize it for your stack | | Week 2 | Autonomous scanning, triage, and patching |
Day-1 goal: threat-model, scan, and triage the bundled canary target. Most teams get there before lunch.
Remind them to export CLAUDE_CODE_SUBAGENT_MODEL=<model-id> so subagents
use the same model as the session.
Then AskUserQuestion with three options:
- Walk me through Day 1 on the canary (~10 min) → run "Guided first run" below.
- I have a question → ask what it is, then switch to Help mode.
- I'll read the README → point at
README.mdStep 1 and stop.
Guided first run
Runs the three Step-1 skills on targets/canary, pausing after each to show
what landed on disk. These only read/write files in the repo; no sandbox
needed.
/threat-model bootstrap targets/canaryvia Task. When done, openTHREAT_MODEL.md, show the focus areas, explain in 2-3 sentences how this steers the scan./vuln-scan targets/canaryvia Task. When done, opentargets/canary/VULN-FINDINGS.md, summarize the count and top 2-3 findings, point atVULN-FINDINGS.json./triage targets/canary/VULN-FINDINGS.jsonvia Task. When done, openTRIAGE.md, explain what changed vs. raw findings (verified, deduped, re-ranked).
Pause for the operator between each (AskUserQuestion); don't barrel through.
Close with a one-line recap of the three artifacts on disk, then point at
README Step 2 for the execution-verified pipeline. Never run vuln-pipeline
or anything that executes target code here; that's Step 2 and needs
Docker + a sandbox.
Help mode
Answer the operator's question using this repo as ground truth: README,
docs/*.md, harness/*.py, dnr_harness/*.py, targets/*/config.yaml,
.claude/skills/*.
Don't answer from general knowledge when the repo has a specific answer.
Routing map
| If the question is about… | Read first | Then offer |
|---|---|---|
| running the pipeline | docs/pipeline.md, README Step 2 | the recon / run command |
| too many findings, triage | docs/triage.md | /triage <path> |
| porting, Java/Go/Rust/etc. | docs/customizing.md, README Step 3 | /customize |
| safety, sandbox, Docker | docs/security.md | cite; no action |
| rate limits, 429, token budget | docs/pipeline.md: Rate limits, docs/troubleshooting.md#rate-limits | cite the numbers |
| duplicates, dedup | docs/troubleshooting.md#duplicate-findings | known_bugs: hint |
| CLI flags, "what does --X do" | harness/cli.py (grep the argparse) | exact flag + example |
| which model, subagent pinning | docs/troubleshooting.md: Subagents | the export line |
| best practices, prompting | docs/best-practices.md, docs/prompting.md | cite the principle |
| threat model, attack surface, scope | docs/threat-model.md | /threat-model bootstrap <target-dir> |
| scan, audit, find vulns | .claude/skills/vuln-scan/SKILL.md | /vuln-scan <target-dir> |
| "how do I start" | README Step 1 | offer Guided first run |
| patching, fix, diff, re-attack | docs/patching.md, README Step 4 | /patch <input> |
| threat hunting, incident response, logs | docs/detection-response.md | /dnr-hunt or /dnr-respond |
| autonomous D&R, dnrcanary | docs/detection-response.md, targets/dnrcanary/README.md | the dnr-pipeline run command |
| binary, embedded, other domains | docs/other-use-cases.md | cite section |
| anything else | README Table of contents | best-match doc |
Answer format
- Direct answer in 2-5 sentences.
> source:the file(s) and section you used.- Next action: one copy-pasteable command or skill invocation, if one applies. If none does, say so.
- If the question is ambiguous, ask one clarifying question; don't guess.
Constraints
- Never fabricate CLI flags or file paths. If unsure,
Grepfor it inharness/cli.pyor the target configs and quote what you find. - If the repo doesn't answer the question, say so plainly and suggest the operator open a GitHub issue on this repo.
- Keep the Q&A dry and cited. Save the warmth for Intro mode.
FAQ
What does the quickstart skill do?
The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…", or just "/quickstart" to get oriented.
How do I install quickstart?
Run npx skills add https://github.com/anthropics/defending-code-reference-harness --skill quickstart in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/quickstart/ (personal) or .claude/skills/quickstart/ (project).
Which AI agents can use quickstart?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is quickstart safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains quickstart?
It is published by anthropics in anthropics/defending-code-reference-harness. It has 1,083 recorded installs.
More from anthropics/defending-code-reference-harness
threat-model
anthropics/defending-code-reference-harness
Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; "bootstrap-then-interview" chains the two when both owner and codebase are present. All write THREATMODEL.md in a shared schema. Use when asked to "threat model", "build a threat model", "map the attack surface", or "what should we be worried about in this codebase".
vuln-scan
anthropics/defending-code-reference-harness
Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in ", or as the step between /threat-model and /triage.
triage
anthropics/defending-code-reference-harness
Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.
patch
anthropics/defending-code-reference-harness
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is written as inert diffs for human review. Writes PATCHES/bugNN/{patch.diff,patchresult.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".
customize
anthropics/defending-code-reference-harness
Adapt this C/C++ ASAN vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. Use when the user wants to port, migrate, retarget, customize, or fork the pipeline for something other than C/C++ memory-safety bugs — web apps, smart contracts, deserialization, ML systems, or any other domain.
verify
anthropics/defending-code-reference-harness
Open the skill to read its SKILL.md instructions.
Popular docs & writing skills
grill-with-docs
mattpocock/skills
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
lark-markdown
open.feishu.cn
飞书 Markdown：查看、创建、上传、编辑和比较飞书中的原生 Markdown 文件。当用户要操作飞书 Markdown 文件，或比较其远端版本及本地草稿时使用。纯本地 Markdown 文件操作不触发本 skill。不负责将 Markdown 导入为飞书在线文档，也不负责文件搜索、权限、评论、移动、删除等云空间管理操作。
writing-beats
mattpocock/skills
Writing, exploit; assemble raw material into a journey of beats, grounding each term before a beat leans on it.
writing-shape
mattpocock/skills
Writing, exploit: shape raw material into an article, paragraph by paragraph.
writing-fragments
mattpocock/skills
Writing, explore: mine raw fragments, no structure yet.
writing-for-agents
mattpocock/skills
Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.