VibeRPGSimulator

Own-app security sweep

Quest: Find and fix exploitable holes in a web app you own before it ships

Proposed, not tested

Equipment

Rogue Claude Code
Quest
Find and fix exploitable holes in a web app you own before it ships
Hero
Claude CodeThe agent that runs the quest
Class
Rogue · Security testing
Weapon
Claude Opus 5.5Greatsword: Anthropic's flagship for hard coding workMana rate 21 per 1k tokens Mana per run without spells: 2,919 mana (77 runs, 21 quests).
Charge
HighReasoning effort
Author
The curator

Security Guidance and Semgrep check code as it is written. Claude Security then scans the repo and verifies each finding, and HawkScan attacks the running app. Use only on apps you own or may test. Semgrep and StackHawk need accounts; the LLM reviews use tokens.

Unappraised: no trial of this exact setup yet.

Skill tree

  1. ScoutGather context

    Nothing equipped here

  2. CraftMake the thing

  3. TestCheck the work

  4. ShipDeliver it

    Nothing equipped here

Quest replay

Quest: "Find and fix exploitable holes in a web app you own before it ships". Four waves, then the Backlog Dragon.

Foes

  • Fog Wraith

Party · Context

  • Claude CodeRogue100/100

  1. Wave 1 of 4 · Scout

    The Fog Wraith steps up.

    What really happensGather context

    Claude Code: Context 100/100.

  2. Explore

    Claude Code sends Explore, a fox scout, into the fog.

    What really happensClaude Code can hand a codebase search to its built-in Explore subagent, which works in its own context window.

    Explore: Context 40/40.

  3. Explore

    Explore sniffs out the right files.

    What really happensThe subagent reads and searches. None of that output lands in the main context.

    Fog Wraith takes 24.

  4. Haze

    The Fog Wraith breathes haze. Swings start to miss.

    What really happensWithout current docs, the agent guesses at APIs that may have changed.

    Explore takes 3. Explore: Context 37/40. Explore: Haze.

  5. Greatsword

    Claude Code swings the Greatsword.

    Fog Wraith takes 36. Fog Wraith falls.

  6. Explore

    Explore returns with a short report.

    What really happensOnly the subagent's final summary comes back to the main agent.

    Claude Code takes 2. Claude Code: Context 98/100. Claude Code: Insight. Explore returns.

  7. Wave 2 of 4 · Craft

    The Breach Spider steps up.

    What really happensMake the thing

  8. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Claude Code takes 6. Claude Code: Context 92/100. Claude Code: Poison.

  9. Venom

    Venom drains a little more context.

    What really happensThe bad change keeps causing trouble until a check catches it.

    Claude Code takes 4. Claude Code: Context 88/100.

  10. Anthropic Security Guidance Plugin

    A ward that watches every edit and commit for holes while the code is written.

    What really happensOn Edit and Write, regex rules flag about 25 risky patterns such as yaml.load, pickle.load, raw innerHTML and hardcoded secrets.

    Commit reviewer: Context 40/40.

  11. Venom cured

    The ward draws out the venom.

    What really happensA check catches the bad change before it spreads.

  12. Exploit

    The Breach Spider lashes at Commit reviewer.

    What really happensThe subagent takes the hit in its own context. The main context stays clean.

    Commit reviewer takes 6. Commit reviewer: Context 34/40. Commit reviewer: Poison.

  13. Venom

    Venom drains a little more context.

    Commit reviewer takes 4. Commit reviewer: Context 30/40.

  14. Anthropic Security Guidance Plugin

    The summons work the problem, each in its own context.

    What really happensEach subagent does its own model and tool work, apart from the main conversation.

    Breach Spider takes 26.

  15. Semgrep Guardian

    A ward that rescans every file the agent writes until Semgrep comes back clean.

    What really happensA hook fires on every file write and scans it with Semgrep Code, Supply Chain and Secrets on Semgrep's hosted scanner.

    Breach Spider takes 44 (critical hit). Claude Code: Ward. Breach Spider falls.

  16. Venom cured

    The ward draws out the venom.

    What really happensA check catches the bad change before it spreads.

  17. Anthropic Security Guidance Plugin

    Commit reviewer returns with a short report.

    What really happensOnly the subagent's final summary comes back to the main agent.

    Claude Code blocks the hit. Commit reviewer returns.

  18. Wave 3 of 4 · Test

    The Bug Slime and the Flaky Wisp step up.

    What really happensCheck the work

    Flaky Wisp: Flicker.

  19. Flicker

    The ward takes the blow.

    What really happensA test or check catches the problem before it lands.

    Claude Code blocks the hit.

  20. Anthropic Claude Security Plugin

    A war band of agents that hunts holes in your own code and proves each one.

    What really happensIndependent verifiers try to prove every candidate a false positive. Only findings with a confirmed exploit path reach the report.

    Mapper: Context 40/40. Threat modeler: Context 40/40. Hunter: Context 40/40. Hunter: Context 40/40. Verifier: Context 40/40. Verifier: Context 40/40.

  21. Pinned

    Pinned in place, it cannot slip away.

    What really happensA test that runs the same way each time shows the real failure.

    Bug Slime: Pinned. Flaky Wisp: Pinned.

  22. Regress

    The Bug Slime lashes at Mapper.

    Mapper takes 3. Mapper: Context 37/40.

  23. Flicker

    The Flaky Wisp uses Flicker.

    Claude Code takes 3. Claude Code: Context 85/100.

  24. Anthropic Claude Security Plugin

    The summons work the problem, each in its own context.

    Flaky Wisp takes 24. Flaky Wisp takes 16. Flaky Wisp takes 0. Flaky Wisp takes 0. Flaky Wisp takes 0. Flaky Wisp takes 0. Flaky Wisp falls.

  25. StackHawk Agent Skills

    A hawk that attacks your running app the way an intruder would, then checks the fix.

    What really happenshawkscan writes a stackhawk.yml config for your app. stackhawk-data-seed can generate seed data so scans reach deeper paths.

    Bug Slime takes 45 (critical hit). Bug Slime falls.

  26. Anthropic Claude Security Plugin

    The summons return with short reports.

    What really happensOnly the subagent's final summary comes back to the main agent.

    Claude Code takes 2. Claude Code takes 2. Claude Code takes 2. Claude Code takes 2. Claude Code takes 2. Claude Code takes 2. Claude Code: Context 73/100. Mapper returns. Threat modeler returns. Hunter returns. Hunter returns. Verifier returns. Verifier returns.

  27. Wave 4 of 4 · Ship

    The Gate Warden steps up.

    What really happensDeliver it

    Gate Warden: Barrier.

  28. Boss · Backlog Dragon

    The Backlog Dragon guards the quest: "Find and fix exploitable holes in a web app you own before it ships".

    What really happensIt stands for the whole quest, every task on the list.

  29. Scope creep

    The dragon breathes scope creep across the party.

    What really happensNew asks pile onto a task while it is underway.

    Claude Code takes 5. Claude Code: Context 68/100.

  30. Greatsword

    Claude Code swings the Greatsword.

    Gate Warden is behind a barrier.

  31. Bar the gate

    The warden raises the gate. Nothing passes until the checks are green.

    What really happensA release waits until tests, builds and reviews pass.

  32. Claw

    The Backlog Dragon uses Claw.

    Claude Code takes 6. Claude Code: Context 62/100.

  33. Greatsword

    Claude Code swings the Greatsword.

    Gate Warden is behind a barrier.

  34. Bar the gate

    The Gate Warden swings the gate shut.

    Claude Code takes 5. Claude Code: Context 57/100.

  35. Scope creep

    The Backlog Dragon uses Scope creep.

    Claude Code takes 5. Claude Code: Context 52/100.

  36. Greatsword

    Claude Code swings the Greatsword.

    Gate Warden takes 60 (critical hit). Gate Warden falls.

  37. Gate open

    The checks turn green and the gate opens.

    What really happensTests, build and review pass, so the release can go.

  38. Claw

    The Backlog Dragon uses Claw.

    Claude Code takes 6. Claude Code: Context 46/100.

  39. Greatsword

    Claude Code swings the Greatsword.

    Backlog Dragon takes 46.

  40. Scope creep

    The Backlog Dragon uses Scope creep.

    Claude Code takes 5. Claude Code: Context 41/100.

  41. Greatsword

    Claude Code swings the Greatsword.

    Backlog Dragon takes 49.

  42. Call the backlog

    The dragon roars, and another task crawls out of the backlog.

    What really happensFinishing one task often surfaces the next one on the list.

  43. Greatsword

    Claude Code swings the Greatsword.

    Bug Slime takes 25. Bug Slime falls.

  44. Scope creep

    The Backlog Dragon uses Scope creep.

    Claude Code takes 5. Claude Code: Context 36/100.

  45. Claw

    The Backlog Dragon uses Claw.

    Claude Code takes 6. Claude Code: Context 30/100.

  46. Greatsword

    Claude Code swings the Greatsword.

    Backlog Dragon takes 47.

  47. Scope creep

    The Backlog Dragon uses Scope creep.

    Claude Code takes 5. Claude Code: Context 25/100.

  48. Greatsword

    Claude Code swings the Greatsword.

    Backlog Dragon takes 45.

  49. Enraged

    Wounded, the dragon rages.

    What really happensThe last stretch of a big job is often the hardest.

    Backlog Dragon: Enraged.

  50. Claw

    The Backlog Dragon uses Claw.

    Claude Code takes 8. Claude Code: Context 17/100.

  51. Compact

    The hero rolls the scroll of memory tight and fights on.

    What really happensWhen context runs low, the agent summarizes the session so far and keeps going. Small details can get lost.

    Claude Code recovers 33. Claude Code: Context 50/100.

  52. Greatsword

    Claude Code swings the Greatsword.

    Backlog Dragon takes 33. Backlog Dragon falls.

  53. Quest clear

    The Backlog Dragon falls. Quest complete.

    What really happensEvery equipped spell did its part of "Find and fix exploitable holes in a web app you own before it ships".

After the battle

  • Claude Code took 14 turns to clear four waves.
  • Context ran low once, so the agent compacted it.
  • No Scout or Ship spell, so those waves ran on basic attacks.
  • Summons took 12 damage in their own context and brought back 8 reports.

Copy this loadout

Prompt for Claude Code

Paste this into Claude Code. It installs each spell, leaves API keys and sign-ins to you, and ends with the command that restarts it with this weapon and charge.

Set up these tools for me in Claude Code.
Loadout: https://vibe-rpg-simulator.vercel.app/loadouts/own-app-security-sweep/

1. Anthropic Security Guidance Plugin
   Source: https://github.com/anthropics/claude-plugins-official/tree/main/plugins/security-guidance
   I type in Claude Code:
     /plugin install security-guidance@claude-plugins-official

2. Semgrep Guardian
   Source: https://github.com/semgrep/guardian/tree/develop/plugin
   Run:
     claude plugin install semgrep@claude-plugins-official

3. Anthropic Claude Security Plugin
   Source: https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security
   I type in Claude Code:
     /plugin install claude-security@claude-plugins-official
     /reload-plugins

4. StackHawk Agent Skills
   Source: https://github.com/stackhawk/agent-skills/tree/main/plugins/hawkscan
   I type in Claude Code:
     /plugin marketplace add stackhawk/agent-skills
     /plugin install wingman@stackhawk

How to do it:
- Skip anything that is already installed. Run the rest in order and check that each step worked.
- Commands under "I type in Claude Code" are mine to enter. List them for me at the end, in order.
- Never ask me to paste an API key or token into this chat. When a command needs one, such as YOUR_API_KEY, give me the full command to run in my own terminal.
- Ask me for any other value you can't work out, such as a project path.
- If a command asks a question or needs a browser sign-in or an open app, tell me what to do and wait.
- If a command fails, follow the install steps in the tool's source for Claude Code instead. Show me any command that is not on this list before you run it, and install nothing else.

When you're done, tell me what is ready and what still needs me. New tools load in a new session, so finish by telling me to restart Claude Code with Claude Opus 5.5 and reasoning effort high:
claude --model opus --effort high

Terminal commands

Or paste these lines into a terminal. The first part installs every spell for Claude Code; the last line starts it with the same weapon and charge. Lines starting with # are notes or commands you type inside the agent.

# Loadout: Own-app security sweep
# Quest: Find and fix exploitable holes in a web app you own before it ships
# Hero: Claude Code · Weapon: Claude Opus 5.5 · Charge: High
# From https://vibe-rpg-simulator.vercel.app/loadouts/own-app-security-sweep/

# 1. Learn the spells
# Craft: Anthropic Security Guidance Plugin
# in Claude Code: /plugin install security-guidance@claude-plugins-official
# Craft: Semgrep Guardian
claude plugin install semgrep@claude-plugins-official
# Test: Anthropic Claude Security Plugin
# in Claude Code: /plugin install claude-security@claude-plugins-official
# in Claude Code: /reload-plugins
# Test: StackHawk Agent Skills
# in Claude Code: /plugin marketplace add stackhawk/agent-skills
# in Claude Code: /plugin install wingman@stackhawk

# 2. Start the hero with this weapon and charge
claude --model opus --effort high

Edit a copy