Security & Testing Agent Skills for Codex CLI

Runs a two-pass vulnerability scan on a snippet, file, or diff — a static pattern pass across fixed categories (injection, secrets, auth…

Hardens a feature against attack before or while it's built — threat-model trust boundaries with STRIDE, apply the Always/Ask-First/Never…

Reviews code for security vulnerabilities across Go, TypeScript, PHP, and infrastructure config.

Audits an agent harness's own configuration — CLAUDE.md, .claude/settings.json, MCP server configs, hooks, and agent definitions — for…

Drives development with tests written before implementation code, in Go, TypeScript, PHP, or any language.

Generates comprehensive unit, table-driven, and concurrency tests for a given function or module — happy paths, error paths, boundary…

Comprehensive web quality audit covering performance, accessibility, SEO, and best practices.

Disciplined diagnosis loop for hard bugs and performance regressions — builds a tight, red-capable feedback loop at the level the bug was…

It fixes the current repository until it's green. It detects the stack, runs tests, type checks, lint, and builds, fixes loop errors, and…

Pre-production audit that scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and…

Package and finalize completed work for delivery — use when a feature is done and ready to ship

The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping.

Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the…

AUTHORIZED USE ONLY: This skill contains dual-use security techniques.

Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server…

Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications.

Configure mutual TLS (mTLS) for zero-trust service-to-service communication.

Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and…

Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling…

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Test-Driven Development workflow principles.