Security & Testing Agent Skills for Codex CLI

Use this skill when integrating Cloudflare Zero Trust Access authentication with Cloudflare Workers applications.

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis.

Detects timing side-channel vulnerabilities in cryptographic code.

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state…

Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure…

Load testing with k6/Artillery, response time thresholds, memory leak detection, N+1 query detection, and CI integration.

Use when finishing a feature, fixing a bug, before committing React code, or when the user types `/doctor`, asks to scan, triage, or clean…

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level…

Use when errors occur deep in execution and you need to trace back to find the original trigger - systematically traces bugs backward…

Creates language variants of existing Semgrep rules.

Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels…

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks…

Verifies code implements exactly what documentation specifies for blockchain audits.

Identifies dependencies at heightened risk of exploitation or takeover.

Use when asked to debug, fix a bug, investigate an error, or do root cause analysis, and when users report errors, stack traces…

Use this skill when writing new features, fixing bugs, or refactoring code.

Guides authoring of high-quality YARA-X detection rules for malware identification.

De-identify clinical research data before LLM-assisted analysis.

Enforces strict pre-delivery self-inspection, disk re-reading, and encoding verification to eliminate AI hallucinations and low-level file…

Demonstrate dependency confusion / substitution (CICD-SEC-3, dependency-chain abuse) during an authorized assessment — getting a build to…

Dependency management, version conflict resolution, security patch updates,