Skill Claude CodeCodex
A first-pass skill for investigating hidden data in files used in capture-the-flag security puzzles. It checks images, audio, video, PDFs, archives, and containers for metadata, embedded files, appended data, and other unusual clues.
Skill Claude CodeCodex
A security review guide for HTTPS, certificates, redirects, HSTS, and TLS settings across websites and APIs. TLS is the security layer that protects connections between clients and servers.
Skill Claude CodeCodex
A security review skill for the life cycle of JWTs, API tokens, refresh tokens, and OAuth or OIDC credentials. It checks how credentials are issued, renewed, revoked, scoped, transmitted, and stored.
Skill Claude CodeCodex
A security assessment guide covering how to identify, verify, classify, and rate weaknesses in networks, hosts, applications, configurations, and source code.
Skill Claude CodeCodex
A first-pass workflow for CTF challenges involving WebAssembly, JavaScript, or browser-side checks. WebAssembly is a compact format that lets code run in a web browser, often alongside JavaScript.
Skill Claude CodeCodex
Bundle skill for authorized web and API authentication assessment. Use when requests involve login flows, sessions, cookies, bearer tokens, refresh tokens, MFA, CSRF boundaries, or mixed browser/API auth and Codex should coordinate multiple auth-focused skills.
Skill Claude CodeCodex
A security-testing guide for XPath injection, a vulnerability where untrusted input changes an XPath query used to search XML data.
Skill Claude CodeCodex
A security-testing guide for cross-site scripting (XSS), an attack that makes a website run unwanted JavaScript in a visitor’s browser. It covers reflected, stored, and DOM-based XSS.
Skill Claude CodeCodex
A security-testing guide for XXE, a flaw where an XML parser is tricked into reading files or making network requests. It covers XML inputs such as APIs, uploads, SOAP services, office documents, SVGs, and PDFs.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: