Skill Claude CodeCodex
Expert Nuxt.js front-end developer for Vue, Composition API, Pinia, useFetch, server routes, and NuxtUI. Use when building Nuxt applications, Vue components, server routes, Pinia stores, i18n, authentication, or SSR/SSG pages.
Skill Claude CodeCodex
Expert PHP developer for Laravel, Symfony, and modern PHP 8.x. Use when writing PHP code, designing Laravel applications, working with Eloquent ORM, Laravel queues, PHP testing with PHPUnit/Pest, or PHP API development.
Skill Claude CodeCodex
Expert Python developer for FastAPI, Django, async services, Pydantic, SQLAlchemy, and Celery. Use when writing Python code, designing REST APIs with FastAPI or Django REST Framework, working with async patterns, database access, Celery background jobs, or pytest testing.
Skill Claude CodeCodex
Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when…
Skill Claude CodeCodex
Detect business logic vulnerabilities in a codebase using a two-phase approach: first perform threat modeling by analyzing the application's domain and generating specific attack scenarios (price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc.), then verify whether those threats…
Skill Claude CodeCodex
Detect insecure file upload vulnerabilities in a codebase using a two-phase approach: first find all file upload handling sites (endpoints, storage calls, multipart form processing), then check whether an attacker can upload malicious files by manipulating file extensions. Requires sast/architecture.md (run…
Skill Claude CodeCodex
Detect GraphQL injection vulnerabilities in a codebase using a two-phase approach: first confirm GraphQL is in use and find sites where operation documents are built unsafely (concatenation, interpolation into query strings), then trace whether user input reaches those sites. Requires sast/architecture.md (run…
Skill Claude CodeCodex
Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a two-phase recon-then-verify approach with subagents. Checks endpoints for missing ownership or authorization checks on user-supplied identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to…
Skill Claude CodeCodex
Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature…
Skill Claude CodeCodex
Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a two-phase approach: first map all endpoints and the role/permission system, then verify each endpoint has proper authentication and authorization checks. Covers unauthenticated access and vertical privilege…
Skill Claude CodeCodex
Detect path traversal vulnerabilities in a codebase using a two-phase approach: first find all file-loading sites where a path is constructed dynamically (open, readFile, sendfile, etc.), then trace whether user-supplied input reaches those sites and can escape the intended base directory. Requires…
Skill Claude CodeCodex
Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a two-phase approach: first find dangerous execution sinks (OS command calls, eval-like functions, unsafe deserialization), then trace whether user-supplied input reaches those sinks. Requires sast/architecture.md (run sast-analysis first). Outputs…
Skill Claude CodeCodex
Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all -results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate…
Skill Claude CodeCodex
Detect SQL injection vulnerabilities in a codebase using a two-phase approach: first find unsafe SQL construction sites (string concat, f-strings, unsafe ORM methods), then trace whether user-supplied input reaches those sites. Requires sast/architecture.md (run sast-analysis first). Outputs findings to…
Skill Claude CodeCodex
Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a two-phase approach: first find all outbound network call sites (HTTP, TCP, DNS requests to remote hosts), then trace whether user-supplied input reaches those call sites. Requires sast/architecture.md (run sast-analysis first). Outputs…
Skill Claude CodeCodex
Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a two-phase approach: first find all template rendering sites where user-supplied input is used as the template string itself (not as context data), then trace whether user-supplied input actually reaches those sites. Requires…
Skill Claude CodeCodex
Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a two-phase approach: first find all HTML, JavaScript, and DOM output sinks where data is rendered without escaping, then trace whether user-supplied input reaches those sinks. Requires sast/architecture.md (run sast-analysis first). Outputs…
Skill Claude CodeCodex
Detect XML External Entity (XXE) vulnerabilities in a codebase using a two-phase approach: first find all XML parsing sites where external entity resolution is not explicitly disabled, then trace whether user-supplied input reaches those parsers. Requires sast/architecture.md (run sast-analysis first). Outputs…
Skill Claude CodeCodex
Security expert skill for input validation, authentication hardening, RBAC, rate limiting, XSS/SQL injection prevention, CORS, and secure headers. Use when reviewing code for security, implementing auth flows, handling user input, file uploads, or when the user asks about security best practices.
Skill Claude CodeCodex
SEO expert for web (Next.js Metadata API, JSON-LD, Open Graph, sitemap) and mobile (Expo deep linking, Universal Links, App Store Optimization). Use when implementing metadata, structured data, canonical URLs, deep links, ASO, or running SEO audits.
Skill Claude CodeCodex
Testing expert for Vitest, Playwright, pytest, Go testing, and PHPUnit/Pest. Use when writing unit tests, integration tests, E2E tests, setting up test infrastructure, mocking dependencies, or debugging flaky tests.
Skill Claude CodeCodex
Guidelines for upgrading Expo SDK versions and fixing dependency issues.
Skill Claude CodeCodex
Use Expo DOM components to run web code in a webview on native and as-is on web. Migrate web code to native incrementally.
Skill Claude CodeCodex
Expert Vue + Vite developer for standalone (non-Nuxt) projects. Composition API, Pinia, Vue Router, TypeScript, and Vite. Use when building Vue SPA/MPA apps, component libraries, or admin dashboards without a meta-framework.