Linmas: Defensive Security Skills for AI Agents

The description states that Linmas is an open-source, Codex-first defensive security review system for AI-assisted software development. It combines eleven focused security skills with a structured workflow and deterministic policy decisions.

It generates Review Capsules, which are portable bundles tied to the exact input (SHA-256 digest and byte length), containing:

• Normalized security findings
• Deterministic policy results
• Evidence of execution
• Human review requirement

The system is designed to be run locally or through Codex CLI, with no automatic approval or remediation. It supports offline execution and includes a reproducible judge demo.

Inference The product appears to be a tool for developers using AI coding agents to perform early-stage security checks on code changes before human review.

The author states that Linmas is inspired by Indonesia’s community protection concept, Perlindungan Masyarakat, and aims to fill a gap in AI-assisted development where security reviews are inconsistent or missing. It positions itself as a first layer of defense for AI-assisted software.

It is not described as:

• A penetration-testing toolkit
• An exploit automation platform
• A system that automatically approves code

Instead, it emphasizes:

• Evidence-based review
• Deterministic policy evaluation
• Human review boundary
• Portable and inspectable results

The project evolved from a collection of prompts into a structured workflow during OpenAI Build Week. The author notes that the tool is not meant to create false confidence, but rather to distinguish evidence from assumption.

Inference Linmas positions itself as a defensive, accountable, and transparent security assistant, not an autonomous remediation tool.

The description states that Linmas targets:

• Solo developers
• Small teams
• AI-assisted software development environments

It is described as being useful for:

• Early-stage risk identification
• Collecting evidence
• Understanding remediation
• Bringing better information to human decision-makers

There is no mention of enterprise customers, specific industries, or use cases beyond general AI-assisted development.

Inference The ICP appears to be developers and small engineering teams using AI coding agents, with a focus on improving security review workflows in early-stage development.

The description states that Linmas is open source. No pricing or monetization model is mentioned. There is no evidence of revenue, subscriptions, or paid features.

Inference The business model appears to be open source with no direct commercial revenue, though the author may seek public review channels for plugin discovery and adoption.

The project was built using:

• Node.js 24
• ES modules
• Markdown-based Agent Skills
• JSON Schema
• Codex CLI integration
• GitHub Actions

It supports:

• Namespaced, installable security skills
• Deterministic policy packs
• Offline before/after comparison
• Portable Proof Chain bundles
• Human review gate

The author notes that the demo requires no provider credentials or network access.

Inference The technical stack is developer-focused, with a strong emphasis on reproducibility, offline capability, and integration with AI agents like Codex.

The description states:

• It was independently developed
• It was submitted to the OpenAI 2026 hackathon
• A real-world incident response case was used for testing
• The author conducted a bounded live test using Codex CLI and gpt-5.6-sol model

However, no evidence of revenue, customers, or adoption beyond the author’s own use is provided.

Inference The project shows early maturity with a working demo and real-world application, but lacks measurable traction or market validation.

The description does not mention specific competitors. However, it makes clear distinctions from:

• Penetration-testing tools
• Exploit automation platforms
• Systems that auto-approve code

It is positioned as a defensive assistant rather than an autonomous security system.

Inference Linmas operates in a niche space of AI-assisted security review, where the key differentiator is evidence-carrying, human-reviewed workflows. No direct competitors are named or described.

• No revenue or customer data: The project has no demonstrated commercial traction.
• Self-reported only: All claims are unverified and based on the author’s own description.
• Limited adoption: No evidence of use beyond the author’s own demos or incident response case.
• Open-source model: While open source can attract users, it does not indicate commercial viability or scalability.
• No third-party validation: No independent review or testing is mentioned.

Inference The project is early-stage, with no clear path to monetization or market adoption. It may be a proof-of-concept rather than a scalable product.

1. What is the actual scope of the real-world incident response case? Was it used in production, and how was it validated?
2. Has Linmas been tested with other AI agents beyond Codex?
3. Are there any plans or early feedback from developers using this tool outside of the author’s own use?
4. How does Linmas handle edge cases or ambiguous inputs that may not fit into its defined security skills?
5. What is the long-term vision for monetization, if any, given its open-source nature?