PYA plugin
PYA runs nine reviewer agents over your code in Claude Code and returns a 0 to 100 security score with an ordered fix list.
- 279 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- Agents only read code and run or change nothing.
- The score does not replace specialist review and may include false findings.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/pyaDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- Agents only read code and run or change nothing.
- The score does not replace specialist review and may include false findings.
This is third-party code. Review the repository files before installing.
What it does
PYA, Protect Your Ass, is a security audit plugin for Claude Code. The `/pya` command runs nine specialists at once: OWASP Top 10:2025 vulnerability search, authorization, secrets, dependencies and malicious packages, infrastructure as code, business logic, agent configurations with MCP and hooks, and AI-written code. A separate verifier double-checks every serious finding. The report has a 0 to 100 score and fixes in the right order. The agents only read code, run and install nothing and stay offline unless asked. Modes include `--scope quick`, `--focus` and `--compliance` for PCI, HIPAA, SOC 2, GDPR and CRA.
Who it is for. Developers and small teams without a dedicated security specialist who need a quick repository audit before release.
Good fit when
- Before release SQL injection, XSS and access check mistakes must be reviewed.
- Keys and passwords are suspected to have leaked into config and logs.
- Dependencies were updated and malicious package versions should be found.
- The project accepts AI-written code and hook and MCP configuration needs review.
- A finding map for PCI DSS or GDPR is wanted.
Not a fit when
- You need a dynamic test against a running service: the agents read code and execute nothing.
- You need an auditor's statement for certification, which a plugin score does not replace.
- You need an offensive penetration test.
Example request
Run /pya --scope quick on this repository and show the score and the three top findings with fix order.Limitations
The plugin is static: agents read code and do not run it, so runtime errors and server configuration stay invisible. The 0 to 100 score helps prioritize but does not guarantee security or replace a specialist. The malicious package list comes from a dated feed whose age is shown in the report and may lag offline. Claude Code 2.1.275 or newer is required for the one-command install. AI review findings can be false, and the verifier reduces but does not remove them.
How to disable. Remove the plugin through `/plugin` or `claude plugin uninstall pya@pya`. Delete audit reports in the project separately.
FAQ
What does it check?
OWASP vulnerabilities, authorization, secrets, supply chain, infrastructure as code, business logic, agent configurations with MCP and AI-written code.
Does it run my code?
No. Agents only read code, install nothing and stay offline until you ask.
How do I choose scope?
`/pya --scope quick` checks code, auth, secrets, dependencies and threats and `/pya --focus <agent>` runs one specialist at full depth.
Are there standards reports?
Yes, `--compliance pci` maps findings to PCI DSS 4.0.1 and `hipaa`, `soc2`, `gdpr` and `cra` are available.
Is it paid?
No. MIT license, no accounts, usage limits or tracking. Costs fall on your Claude access.
Discussion
No questions or reviews yet.
Related
PluginsA code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
Offline security scanner for code and dependencies with a plugin and MCP: 132 rules, findings with evidence at file:line.
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
Prowler plugin for Claude Code
Prowler for Claude Code
A plugin that takes a cloud account toward CIS, PCI-DSS and other frameworks: reads Prowler Cloud reports, fixes failures and proposes a rescan
README in short
The README covers installation, a sample report on a hostile repository, nine agents with weights, how an audit works, commands and an FAQ. MIT license.