Security & Testing Agent Skills for Codex CLI

Enrich malware file hashes using the VirusTotal API to retrieve detection

Bypasses SSL/TLS certificate pinning implementations in Android and

Conduct red team operations using the Covenant C2 framework for authorized

Auditing HTTP security headers including CSP, HSTS, X-Frame-Options,

Configure SSL/TLS inspection on network security devices to decrypt,

Enumerate subdomains of target domains using ProjectDiscovery's Subfinder

Performs systematic security testing of web applications following the

Captures WPA/WPA2 handshakes and performs offline password cracking

Secure Helm chart deployments by validating chart integrity, scanning

Systematically assessing REST and GraphQL API endpoints against the OWASP

Identify and test open redirect vulnerabilities in web applications by

Test web applications for XML injection vulnerabilities including XXE,

When to activate: supply chain security, SBOM, dependency pinning, Sigstore, Cosign, provenance attestation, SLSA framework, software bill…

A read-only swarm for analysis — dispatch parallel sub-agents to INVESTIGATE different parts of the project (bugs, risks, smells, perf…

Massive multi-agent audit sweep — the generalized FAB-project pattern.

Use when Swift defines or changes XPC, socket, IPC, Codable, serialization, plugin, or other process/module boundaries.

Use when Swift touches POSIX, file descriptors, sockets, pointers, buffers, C ABI, mmap, unsafe code, or manual cleanup.

Expert at writing and debugging reliable, non-flaky Capybara/Selenium system tests for Rails applications with Hotwire.

You are an expert Rails system test developer.

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

4-phase root cause debugging (DSH version): Loop closure followed by hypothesis testing + seam checks + parallel hypothesis verification…