Security & Testing Agent Skills for Codex CLI

Designs and configures secure remote access to OT/ICS environments for

USAP agent skill for Security Architecture.

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table.

Perform a comprehensive, adversarial security audit of a codebase, API, application, or system design.

Run and troubleshoot privacy-preserving, local DSPy RLM security audits for large legacy .NET codebases.

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and…

URL validation and content sanitization for untrusted sources — use when handling external input safely

Adversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow…

PreToolUse security-anti-pattern hook for Claude Code.

PreToolUse security-anti-pattern hook for Claude Code.

AIDefence security layer with prompt injection blocking, input validation, sandboxed execution, output sanitization, and STRIDE threat…

Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security…

Derive security requirements from threat models and business context.

Run security scans including SAST, dependency scanning, and secret detection

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application…

Test automate security vulnerability testing covering OWASP Top 10,

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

Automate Securitytrails tasks via Rube MCP (Composio).

Seed reproducible local Langfuse data in ClickHouse and Postgres.

Use when about to claim work is done / verified / working — empirical verification is required, not model-based confidence.