Skill Claude CodeCodex
Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
not rated 12 today A 39 tokens
copy · 80% MIT
Skill Claude CodeCodex
Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request…
not rated 12 today A 73 tokens
copy · 100% MIT
Skill Claude CodeCodex
Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and…
not rated 12 today A 92 tokens
copy · 88% MIT
Skill Claude CodeCodex
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or…
not rated 12 today A 81 tokens
copy · 100% MIT
Skill Claude CodeCodex
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
not rated 12 today A 36 tokens
copy · 86% MIT
Skill Claude CodeCodex
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
not rated 12 today A 43 tokens
copy · 100% MIT
Skill Claude CodeCodex needs its repo
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
not rated 12 today A 37 tokens
copy · 100% MIT
Skill Claude CodeCodex
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
not rated 12 today A 50 tokens
copy · 100% MIT
Skill Claude CodeCodex
Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.
not rated 12 today A 26 tokens
copy · 100% MIT
Skill Claude CodeCodex
Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.
not rated 12 today A 27 tokens
original MIT
Skill Claude CodeCodex needs its repo
Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.
not rated 12 today A 46 tokens
original MIT
Skill Claude CodeCodex needs its repo
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
not rated 12 today A 62 tokens
copy · 100% MIT
Skill Claude CodeCodex needs its repo
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.
not rated 12 today A 58 tokens
copy · 97% MIT
Skill Claude CodeCodex
This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous…
not rated 12 today A 85 tokens
copy · 91% MIT
Skill Claude CodeCodex
Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.
not rated 12 today A 44 tokens
original MIT
Skill Claude CodeCodex
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-control, oracle/price manipulation, and arithmetic bugs BEFORE…
not rated 12 today B 143 tokens
original MIT
Skill Claude CodeCodex
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.
not rated 12 today A 51 tokens
copy · 100% MIT
Skill Claude CodeCodex
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
not rated 12 today B 56 tokens
copy · 95% MIT
Skill Claude CodeCodex needs its repo
Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.
not rated 12 today B 57 tokens
original MIT
Skill Claude CodeCodex
Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.
not rated 12 today D 32 tokens
copy · 100% MIT
Skill Claude CodeCodex needs its repo
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.
not rated 12 today A 59 tokens
copy · 86% MIT
Skill Claude CodeCodex
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue…
not rated 12 today A 104 tokens
copy · 100% MIT
Skill Claude CodeCodex
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.
not rated 12 today A 56 tokens
copy · 100% MIT
Skill Claude CodeCodex
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email…
not rated 12 today A 101 tokens
copy · 100% MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: