Skill Claude CodeCodex
Software engineering best practices grounded in C.S. Peirce's abductive reasoning and his triadic framework (abduction–deduction–induction, sign–object–interpretant, Firstness–Secondness–Thirdness). Use this skill whenever the user is debugging a defect, investigating an incident or outage, doing root cause analysis…
Skill Claude CodeCodex
Collect digital evidence in order of volatility, or destroy the thing you came for — memory, network state, and running processes evaporate the moment you pull power or start "just looking," and the act of collecting alters the scene, so order and method are the evidence's admissibility, not a formality. Use whenever…
Skill Claude CodeCodex
Design LLM and agentic systems so that retrieved content is data and never instruction — instruction authority comes from the channel, tool authority is granted by deterministic policy before the model runs, and the untrusted-content + private-data + external-egress trifecta is never unmediated. Use whenever an LLM…
Skill Claude CodeCodex
Triage a security alert queue by expected loss, not by the severity label the tool stamped — because analyst attention is a scarce, exhaustible resource and a SOC's real failure is not a missed rule but a queue that trains its analysts to dismiss. Use whenever there is a backlog of alerts to prioritize, a "we get…
Skill Claude CodeCodex
Start from "this step already succeeded" and map what the attacker reaches next — the identity held at that position, everything that identity unlocks, and the choke point whose removal cuts the most paths at once. Use whenever a finding is confirmed and the question turns to impact, whenever a design assumes a…
Skill Claude CodeCodex
Make a logical operation that spans several writes to persistent state land all-or-nothing, isolated from concurrent writers, with dependents cleaned up in the same transaction. Use this whenever one conceptual operation involves multiple writes — insert-then-delete, merge, consolidate, migrate, move-across-tables…
Skill Claude CodeCodex
Enumerate the attack surface of an AUTHORIZED target and rank it into a reproducible, falsifiable candidate queue — reachability × asset value × technique plausibility — before anyone touches a payload. Use whenever the user asks "where should we start", "what's our attack surface", "what should we test first", "map…
Skill Claude CodeCodex
Validate any audit finding, bug report, or proposed fix against the actual current file content before changing a single line. Use this whenever you act on a problem someone else reported — a human reviewer, another AI auditor, a linter, a security scan, a "the audit found X in file Y" message — and whenever you are…
Skill Claude CodeCodex
Build the actor × resource × action matrix a system implicitly claims to enforce, then test the cells it never wrote a test for — because authorization bugs are absences, and you cannot grep for an absence. Use whenever a system has more than one kind of user, more than one tenant, or any object with an owner …
Skill Claude CodeCodex
Audit the bug fixes themselves — a patch proves that someone knew something was wrong there, never that it is now right. Hunt the eight ways a fix falls short: it covers the demonstrated input instead of the property, one path instead of every path, the wrong layer, the symptom instead of the cause, nothing enforcing…
Skill Claude CodeCodex
Look past the obvious layer of an investigation — past sink-grep keyword lists, past the exhausted question family, past the single implementation where a bug class was first found. Use whenever a hunt is anchored on dangerous-function greps (eval, subprocess, open), when the scanner's output is being treated as the…
Skill Claude CodeCodex
Tracking and preserving the origin of every assertion as it travels through drafts, handoffs, summaries, and documents — ensuring confidence levels, scope bounds, and evidence pointers are never stripped in transit. Use whenever findings move between people or phases: postmortems, incident briefs, audit handoffs…
Skill Claude CodeCodex
Treat any code or data that runs on a device the user controls as code and data the adversary controls — the mobile app, the single-page app, the desktop client, the game — because the user can root the phone, hook it with Frida, bypass the certificate pin, read the "encrypted" local database, and patch out any check…
Skill Claude CodeCodex
Reason about cloud compromise on the identity and control-plane graph, not the network diagram — because in cloud the control plane is an internet-reachable API authorized by credentials, it sits beside the data plane rather than above it behind a firewall, and a stolen key is one AssumeRole from the whole account.…
Skill Claude CodeCodex
Systematic assessment of a codebase's living, dead, and fossil modules — scan, categorize, prioritize, act. Use when the user says "audit the codebase", "find dead code", "what can we delete", "clean up the repo", "module archaeology", "codebase health", "what's unused", "technical debt inventory", or when a project…
Skill Claude CodeCodex
Reason about concurrent execution in terms of shared mutable state, invariants, and happens-before ordering — not in terms of "adding a lock" or "it works on my machine". Use whenever code can run more than once at a time: threads, async tasks, goroutines, workers, multiple processes or replicas, retries, webhooks…
Skill Claude CodeCodex
Treat a container as isolation, not as a security boundary — because "it runs in a container" is not "it is contained": it shares the host kernel, and the real perimeter is the kernel attack surface it can reach, the provenance of the image it was built from, the orchestration identity it holds, and the escape surface…
Skill Claude CodeCodex
Make containment decisions before scope is known, reasoning in reversible-versus-irreversible moves — because acting tips off the adversary (they burn down, accelerate, or pivot) while not acting lets the bleed continue, and "we don't fully understand it yet" must never quietly become "so we did nothing." Use in an…
Skill Claude CodeCodex
Distinguish a control that exists from a control that works — because compliance attests existence ("MFA is enabled") while security requires effectiveness ("MFA that cannot be phished or bypassed on this path"), and the checkbox is passed by the presence of the control, not by its resistance to the threat it names.…
Skill Claude CodeCodex
Turn "we found a credential" into a finding by triaging what the material actually is, what it authenticates as, what it authorizes, for how long, and how to revoke it — because a Slack webhook and a long-lived cloud root key are both "a secret" and differ by orders of magnitude in blast radius. Use whenever secret…
Skill Claude CodeCodex
Judge a cryptographic system by how it is used, not by which primitive it names — because "we use AES-256" says nothing, and almost every real-world break is a misuse (reused nonce, ECB, unauthenticated ciphertext, a padding oracle, a homemade KDF, an accepted downgrade) sitting on top of a perfectly good algorithm.…
Skill Claude CodeCodex
Hunt the one bug class in machine learning whose symptom is a better score — information from the evaluation set reaching the model through preprocessing, time, groups, duplicates, features derived from the label, or a test set spent on tuning. Use whenever a dataset is split, a pipeline is fitted, a feature is…
Skill Claude CodeCodex
You cannot protect, delete, or report on data whose flow you have not mapped — a "delete my data" request, a breach-scope estimate, or a "we don't store PII" claim is only as true as your knowledge of where the data actually went, and it always went further than the schema says: into backups, logs, caches, analytics…
Skill Claude CodeCodex
Writing reports, documentation, findings, and explanations that survive cross-examination — separating fact from inference, admitting uncertainty without weakening the conclusion, never overclaiming. Use this skill whenever the user is writing or reviewing a report, audit deliverable, postmortem, technical doc…