Security & Testing Agent Skills for Codex CLI

Master major dependency version upgrades, compatibility analysis, staged upgrade strategies, and comprehensive testing approaches.

Deploys canary files (honeytokens) across file systems to detect ransomware

Deploys and configures CrowdStrike Falcon EDR agents across enterprise

Deploys and configures osquery for real-time endpoint monitoring using

Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit…

Resolve a deployment_id into the artifacts that make up one agentic deployment and build the evidence graph every other attestation skill…

Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer…

Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and…

Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM

Detect lateral movement in Azure AD/Entra ID environments using Microsoft

Detect Azure service principal abuse in Microsoft Entra ID using KQL detection

Performs statistical analysis of Zeek conn.log connection intervals

Detect Business Email Compromise (BEC) fraud, where attackers impersonate

Deploy and operationalize Amazon GuardDuty, covering protection plans

Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the…

Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and…

Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering…

This skill teaches security teams how to detect and respond to unauthorized

Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by…

Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query…

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy