Skill Claude CodeCodex
Design deception so that a triggered decoy is a true positive by construction — a honeytoken, honeypot, or canary earns its keep only if nothing legitimate ever touches it, which turns "someone touched it" into signal with a near-zero false-positive rate, the inverse of every noisy detection you own. Use whenever…
Skill Claude CodeCodex
Capture a technical decision while the context still exists — the forces at the time, the alternatives and why each was rejected, the assumption it rests on, its reversibility, and the condition that should reopen it. Use whenever a choice is being made that someone will later have to live with or undo: picking a…
Skill Claude CodeCodex
Know what you actually run, where it came from, and what changed — manifest vs lockfile vs installed vs shipped, identity before trust, pinning by digest, and vulnerability reports treated as candidates until reachability is shown. Use whenever a dependency enters, moves, or is questioned: "add this package"…
Skill Claude CodeCodex
Turn a detection requirement into a deployed, tested, versioned rule — with a benign twin that must NOT fire, an explicit false-positive budget, a volume estimate before deploy, and a tuning history that records every silently narrowed scope. Use whenever the user writes or reviews an alert, a Sigma/KQL/SPL/EQL/YARA…
Skill Claude CodeCodex
Keep any consequential output path reproducible bit-for-bit and tamper-evident — no floats in the decision path, canonical typed serialization, SHA-256 sealing, and a determinism check. Use this whenever you build or review code that produces a verdict, score, decision, risk number, classification, or any result that…
Skill Claude CodeCodex
Disciplined diagnosis loop for hard bugs and performance regressions — build a tight feedback loop FIRST, then hypothesize, never the reverse. Use when the user says "diagnose"/"debug this"/"why does this fail"/"it's broken"/"it's slow", or reports something throwing/failing/flaky/wrong. Complements…
Skill Claude CodeCodex
Turn a plausible hypothesis into an earned verdict with the cheapest experiment that can kill it — binary oracle with a canary value, a negative control inside the same run, prediction stated before execution, novelty gate before writing, and every link in the evidence chain labelled by epistemic level. Use whenever a…
Skill Claude CodeCodex
Decide whether observed activity is malicious when the tool, command, or API call is itself legitimate — the living-off-the-land problem, where the artifact is identical for the admin and the intruder and the verdict lives entirely in context. Use whenever you must call a signal benign or malicious and the signal…
Skill Claude CodeCodex
Turn a scanner hit or a CVSS score into a real risk decision by proving, in this deployment, that the vulnerable code is reachable, reached by attacker-controlled input, and exploitable given the mitigations actually in place — because "could be exploited" is not "is exposed" and a version match is not a…
Skill Claude CodeCodex
Write tests that can actually fail, and prove it — see the test red before you trust it green, break the code deliberately as a negative control, and strengthen the oracle from "it ran" to "it is right". Use whenever tests are being written, reviewed, fixed, or relied on: "add tests for this", "write unit tests", "the…
Skill Claude CodeCodex
Govern what happens to a confirmed finding once it is reported and you are not going to publish it — the difference between disclosing an instance, a mechanism, and a hunting method; the patch-diffing window that leaks the class whether or not you write a word; custody of the PoC and of any data you touched confirming…
Skill Claude CodeCodex
Decide what to record today so that tomorrow's reconstruction is possible — derive fields from the questions someone will have to answer under pressure, log the inputs to decisions rather than only their outcomes, correlate across services, keep the event schema a versioned interface, and make silence distinguishable…
Skill Claude CodeCodex
Keep an investigation alive and productive when every hypothesis has been refuted, the target looks hardened, and the session feels empty — refutation is terrain mapping, pivot the question family instead of abandoning the target, and never convert "we found nothing" into "there is nothing". Use whenever a hunt…
Skill Claude CodeCodex
Protect repository history during AI-assisted and agentic coding by tagging a restore point before each session, forbidding history-rewriting operations, and verifying actual repo state before claiming anything about it. Use this whenever an AI agent (Claude Code or similar) is about to make changes to a git…
Skill Claude CodeCodex
Make code that runs on degraded, legacy, reconstructed, or unverifiable input fail visibly instead of returning a plausible-but-wrong answer. Use this whenever you write or review backward-compatible deserialization, loaders for data saved by an older schema, best-effort guarantees, optional components that may be…
Skill Claude CodeCodex
Run a threat hunt as a falsifiable hypothesis about adversary behavior, not a keyword sweep — state before you query what you expect to see if it is true, what would refute it, and what "found nothing" actually proves, which is almost always far less than the hunter wants to claim. Use whenever someone is threat…
Skill Claude CodeCodex
Build a defensible timeline of what happened from heterogeneous, imperfectly-clocked sources — separating recorded time from actual time, ordering from causation, and "no event" from "no coverage". Use whenever events from more than one source must be placed in sequence: incident response, outage postmortems, forensic…
Skill Claude CodeCodex
Grade the source and the indicator before acting on either — because an indicator is not intelligence and a feed is not truth, and auto-acting on ungraded intel means blocking benign traffic, chasing decayed IOCs, and spending analyst trust on someone else's low-confidence guess. Use whenever threat intelligence…
Skill Claude CodeCodex
Hunt for violations of declared or implied security invariants across transitions — a property established at T0 (validation, authority, identity, integrity, namespace) must still hold when the effect happens at Tn. Use whenever auditing or debugging anything with state transitions, redirects, resume/checkpoint flows…
Skill Claude CodeCodex
Classify an action by reversibility and blast radius before executing it, then require a gate proportional to what cannot be undone — preview the exact targets, assert the expected count, take a restore point, and write the undo plan before the action, not after. Use before any destructive, bulk, or outward-facing…
Skill Claude CodeCodex
Architect any system that produces a consequential output so that the LLM stays entirely out of the decision path and only narrates an already-sealed result. Use this whenever an LLM is anywhere near a verdict, score, classification, ranking, risk number, approval, or any output that triggers an action or becomes…
Skill Claude CodeCodex
Build a model evaluation that can actually fail — a mandatory baseline, a metric that matches the decision the output feeds, an interval instead of a point estimate, a test set treated as a consumable, subgroup breakdowns that expose what the aggregate hides, and negative controls that prove the pipeline is capable of…
Skill Claude CodeCodex
Search an input space too large to enumerate, with an oracle strong enough that the bug is visible when it is hit — property-based tests, structure-aware fuzzing, differential and metamorphic oracles, corpus and coverage discipline, shrinking, and crash triage that separates a reproducer from a finding. Use whenever…
Skill Claude CodeCodex
Threat-model operational technology by inverting the IT reflexes — in OT/ICS the priority is availability and physical safety, not confidentiality, so the moves that are correct on a corporate network (patch immediately, scan aggressively, force MFA, encrypt everything) can halt a process, trip a safety system, or get…