Injection
SQL/NoSQL/OS command/LDAP/template. String-built queries or shell from untrusted input. Fix: parameterize, use the platform's safe API.
The pack · 01 / 14 →
VAPT
Malinois
the VAPT dog. Vulnerability assessment for source code, web apps, APKs and IPAs, then the report. Active tests stay in scope.
users.ts
12users.get("/:id", async (req, res) => {
13 const sql = "SELECT * FROM users WHERE id = " + req.params.id; const row = await db.query("SELECT * FROM users WHERE id = $1", [req.params.id]);
14 const row = await db.raw(sql);
15 res.json(row);
16});
SQL injection
ExploitGET /users/1 OR 1=1 dumps every user
FixSmallest change suggested
Malinois is watching$ /watchdog-go-vapt code0 found · 0 fixed
What it does
On duty while you build.
A security-review lens that stays on all session, plus on-demand audits.
The always-on lens flags injection, broken authz/authn, secrets, SSRF, path traversal, unsafe deserialization, weak crypto and insecure defaults as you work.
What it checks
8 things Malinois looks for.
Broken authz
missing ownership/role check per object (IDOR/BOLA), client-trusted role, endpoints with no guard.
Broken authn/session
weak token checks (`<` vs `<=` on expiry), predictable ids, missing signature verification, fixation.
Secrets
hardcoded keys, tokens, passwords in source, config, history. Redact in any output; never echo full secret.
SSRF / path traversal
user-controlled URLs or paths reaching fetch/file APIs.
Unsafe deserialization / eval
pickle, native deserialize, `eval`, template eval on untrusted data.
Crypto
MD5/SHA1 for passwords, ECB, static IV, homemade crypto, no constant-time compare.
Insecure defaults
debug on, permissive CORS/CSP, verbose errors, TLS verify off.
Commands
Send Malinois out.
Runs these scanners when installed, then reads the code they can't understand:
- pip-audit
- osv-scanner
- govulncheck
- bundler-audit
- gitleaks
- trufflehog
Static audit of a source repo (SAST + dependency CVEs + secrets)
Assessment of a running web app (scope-gated)
Static Android APK audit (OWASP MASVS)
Static iOS IPA audit (OWASP MASVS)
Merge the session's findings into one ranked report
- /watchdog-go-web
- /watchdog-go-marketplace
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds a deliberately vulnerable Express API (18 planted vulns, 2 decoys) and an answer key. First run of /watchdog-go-vapt code (2026-10-27, one run per model, skill text given to a subagent):
found
Haiku 5.518/18
Sonnet 5.518/18
Opus 5.518/18
Rules of engagement
What Malinois will never do.
- 1
Authorized, in-scope targets only. Static review of code the user owns is fine. Active testing (requests/scans/fuzzing against a live system) needs the target in the user's written scope — if unclear, ask and wait.
- 2
Findings first. Write PoC/exploit code only when the user asks AND the target is in scope.
- 3
Root cause over symptom: grep every caller before you call something safe.
- 4
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Malinois, answered.
What does Malinois check for?
Malinois is Watchdog's vapt dog for Claude Code. It looks for Injection, Broken authz, Broken authn/session, Secrets, SSRF / path traversal, Unsafe deserialization / eval, Crypto and Insecure defaults. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Malinois in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-vapt. It also has /watchdog-go-vapt web, /watchdog-go-vapt apk, /watchdog-go-vapt ipa and /watchdog-go-vapt report. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Malinois use?
When they're installed, Malinois runs pip-audit, osv-scanner, govulncheck, bundler-audit, gitleaks and trufflehog, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Malinois safe to run on my project?
Yes. Its first rule: Authorized, in-scope targets only. Static review of code the user owns is fine. Active testing (requests/scans/fuzzing against a live system) needs the target in the user's written scope — if unclear, ask and wait. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).