Security & Testing Agent Skills for Codex CLI

Probe a target for accidentally-served secret-bearing files in the web root — .git/, .env, .DS_Store, backup files, database dumps, key…

Detect Kerberos Golden Ticket forgery (e.g.

Detects insider data exfiltration by analyzing DLP policy violations,

Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS

Detect malicious scheduled task creation and modification using Sysmon

Detects and analyzes malicious behavior in mobile applications through

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes…

Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis…

Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay…

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path…

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring…

Detect and prevent QR code phishing (quishing) attacks that embed

Detects ransomware encryption activity in real time using entropy

Detect RDP brute force attacks by parsing Windows Security Event Logs

Discover and inventory shadow API endpoints that operate outside

Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection

Detects sophisticated cyber-physical attacks that follow the Stuxnet

Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands,

Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM