Security & Testing Agent Skills for Codex CLI

Detect broken access control — IDOR/BOLA and missing function-level checks — against a web application from authorization decisions…

Harden a web application's authentication and session management against takeover — rate limiting and lockout, MFA, credential-stuffing…

Find and prove cross-site request forgery in a web application during an authorized assessment.

Harden a web application against cross-site request forgery with anti-CSRF tokens, SameSite cookies, and origin validation, and detect…

Fingerprint a web application's stack — server, framework, language, WAF, and exposed metadata — during authorized recon.

Find and prove insecure direct object reference / broken object-level authorization (BOLA) in a web application during an authorized…

Confirm and safely demonstrate OS command injection in a web application during an authorized assessment.

Detect OS command injection attempts and successful execution against a web application using request telemetry, process/EDR events, and…

Find and prove path traversal / local file inclusion in a web application during an authorized assessment.

Detect path traversal and local file inclusion attempts and success against a web application from request logs and file-access telemetry.

Comprehensive web quality audit covering performance, accessibility, SEO, and best practices.

Find and prove reflected cross-site scripting in a web application during an authorized assessment.

Harden a web application by suppressing stack-leaking response headers and deploying the security header set (CSP, HSTS…

When to activate: CSP, CORS, XSS prevention, CSRF, SRI, iframe sandbox, Trusted Types, web security headers

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access…

Confirm, characterize, and demonstrate the impact of SQL injection in a web application during an authorized assessment.

Detect SQL injection attempts and successful exploitation against a web application from logs, WAF events, and database telemetry.

Confirm and characterize XML external entity (XXE) injection in a web application during an authorized assessment.

Detect cross-site scripting attempts and successful injection against a web application using request telemetry, Content-Security-Policy…

Harden a web application against XML external entity (XXE) injection by disabling DTD and external-entity processing in every XML parser…

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626…