Security & Testing Agent Skills for Codex CLI

Design and review server-side authorization for users, services, organizations, resources, and individual fields.

This skill automates API endpoint testing, including request generation, validation, and comprehensive test coverage for REST and GraphQL…

Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks

Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.

Testing patterns for Prowler API: JSON:API, Celery tasks, RLS isolation, RBAC.

Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need…

Apply BambooHR security best practices for API keys, webhook verification,

Diagnosis loop for bugs and performance regressions.

Blind-test how a skill or prompt change affects agent behavior before promoting it.

Apply when debugging. Trace each symptom to its root cause and fix it there; reproduce first, ask why until you reach it, resist nil-check…

Test-driven development with red-green-refactor loop.

Use when facilitating BDD collaboration between developers, testers, and business stakeholders.

Independent local multi-model review for contested, security-sensitive, high-risk, or merge-critical plans and changes.

Bug condition/postcondition formalization as testable Behavior Contracts.

Go behind a program to discover what it ACTUALLY uses — its real dependencies, libraries, syscalls, files, network endpoints, env/config…

Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.

Find what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running…

Safety guardrails for destructive commands.

Freshly judge whether a finished change is actually proven against bead or caller acceptance — the independent verdict before merge…

Bug bounty program management and security disclosure expertise for smart contracts.

Proactively hunt the codebase for bugs of every size — major reliability bugs (connection/network failures, missing timeouts, unhandled…