Skill Claude CodeCodex
Hunt the bugs that live where two components read the same bytes and disagree about what they mean — the validator parses one way, the executor another, and the attacker writes input that is two things at once. Use whenever a value crosses a component, language, or process boundary and is re-interpreted — proxy in…
Skill Claude CodeCodex
Treat the CI/CD pipeline as a privileged execution environment that runs attacker-influenceable code with production credentials — not as configuration — because a build step is arbitrary code execution holding the keys to deploy, and the pipeline sits inside your trust boundary while rarely being modeled as an attack…
Skill Claude CodeCodex
Run an AUTHORIZED, collaborative purple-team exercise — turn each attack technique into a detection hypothesis, detonate it minimally and marked, and measure whether the blue side prevented it, detected it, or missed it entirely. Use this whenever the user wants to validate detection coverage, test whether a control…
Skill Claude CodeCodex
Treat a backup you have not proven restorable and untampered as a hope, not a recovery plan — because the backup is inside the blast radius (same domain credentials, same network, same admin), and ransomware operators delete or encrypt backups before they detonate, so "we have backups" answers a question you did not…
Skill Claude CodeCodex
Adversarial security auditing and red-teaming of your own systems with strict epistemic discipline. Use this skill whenever the user is red-teaming, doing a security audit, adversarial review, threat modeling, or "trying to break" their own code or system; whenever they ask you to find bugs, vulnerabilities, invariant…
Skill Claude CodeCodex
Write the report that actually gets the class fixed — survivable in a triage queue of forty, severity scored to the demonstrated impact instead of inflated, framed so that closing your instance does not close the underlying pattern, and followed through until the patch is verified against the class and not merely…
Skill Claude CodeCodex
Find the places in your own code where a small input buys a large amount of work or memory, and bound them — input-controlled loops and allocations, super-linear algorithms, catastrophic regex backtracking, decompression and expansion ratios, unbounded fan-out and retries, and missing backpressure. Use whenever…
Skill Claude CodeCodex
Reconstructing how an undocumented, closed, or unfamiliar system works when you do NOT have its design — a binary, a network protocol, a file or wire format, an undocumented or third-party API, a firmware image, a memory dump, an opaque database, or a model whose behavior you can only infer from inputs and outputs.…
Skill Claude CodeCodex
Reason about integrity you cannot verify from inside the thing you are verifying — a compromise below your vantage point is invisible because it controls what you see, so a bootkit that owns UEFI or SPI flash shows a spotless OS to every OS-level scanner, and trust must be anchored to a root below the layer that could…
Skill Claude CodeCodex
Treat credentials as a lifecycle — issued, scoped, distributed, used, rotated, revoked — with redaction enforced at the boundary and rotation rehearsed before it is needed. Use whenever a secret is created, read, passed, logged, printed, committed, or exposed: API keys, tokens, passwords, private keys, connection…
Skill Claude CodeCodex
Deliberate, security-first software construction that assumes a hostile user rather than an ideal one. Use this skill whenever code is being designed, written, extended, refactored, or reviewed before merge — features, endpoints, APIs, parsers, auth, file/DB/network/subprocess handling, schemas, architecture decisions…
Skill Claude CodeCodex
Reason about attacks that exploit human trust rather than a software flaw — where the target made a locally reasonable decision on deliberately crafted context, and no patch fixes it because the "vulnerability" is a person doing their job. Use whenever the vector is a human: "was this phishing", "how did they fall for…