Agent skills for Codex CLI

USAP agent skill for Security Architecture.

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table.

Comprehensive security scanning and vulnerability detection.

Audit a codebase or directory for security issues (hardcoded secrets, injection, unsafe deserialization, weak crypto, authz gaps) and…

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and…

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks.

Use when the user takes over an inherited system, codebase, server, or cloud account from a prior developer — or when leaked secrets, open…

Perform language and framework specific security best-practice reviews and suggest improvements.

Build a minimal but real security policy for sensitive apps.

Use when storing credentials securely, encrypting data, implementing passkeys, securing AI/agentic features against prompt injection, code…

Security-first auditing of AI-generated code — Level 1 quick checks during /toh-dev and /toh-test (hardcoded secrets, dangerous code…

URL validation and content sanitization for untrusted sources — use when handling external input safely

Adversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow…

Generated code must be aligned with security headers (e.g. no unsave JS eval).

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and…

Use this skill when the user asks for a security and/or performance audit of an Android app — e.g. "audit security + performance của app…

Produces a factual security posture document (docs/security-posture.md) and engineering roadmap by reading the codebase and any prior…

Use when the user mentions security review, App Store submission prep, Privacy Manifest requirements, hardcoded credentials, or sensitive…

Analyze code, infrastructure, and configurations by conducting comprehensive

Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps.

Derive security requirements from threat models and business context.