EndoStack: security-first workflows for coding agents

EndoStack makes coding agents plan, threat-model, build, review and verify before they ship. An open-source plugin of 36 skills, 23 playbooks and 25 principles for any agent that reads SKILL.md. By Tarique Smith.

A threat model and a security review count toward done. Before an agent builds anything that touches a trust boundary, it ranks abuse paths and names a proof for each serious mitigation. Before it ships, it reviews the final diff and returns block, fix-before-merge or ok, with file:line, an exploit path and evidence for every finding.

Works in Claude Code, Codex CLI, Cursor, Gemini CLI, GitHub Copilot, Goose, Amp, Kiro, Cline, Roo Code, OpenCode and other agents. MIT licensed.

• Source and install instructions on GitHub
• Security belongs in the coding agent’s definition of done
• More from the Lab