Skill Claude CodeCodex
Security assessment guidance for applications that use AI models, agents, MCP tools, retrieval systems, memory, plugins, or model services. It covers risks such as prompt injection, unauthorized actions, and data exposure.
Skill Claude CodeCodex
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
Skill Claude CodeCodex
A workflow for analysing and replaying requests made by mobile apps, browser JavaScript, or desktop clients during authorised security testing.
Skill Claude CodeCodex
A toolkit for encoding, decoding, hashing, and encrypting data in formats such as Base64, hexadecimal, URLs, JWTs, AES, RSA, and common ciphers.
Skill Claude CodeCodex
A knowledge base of cryptographic attacks for capture-the-flag challenges, including attacks against RSA, AES, elliptic-curve cryptography, random generators, and lattice systems.
Skill Claude CodeCodex
A reference guide for miscellaneous Capture the Flag (CTF) challenges, which are security puzzles with hidden answers. It covers sandbox escapes, decoding, hidden data in files, virtual-machine reversing, platform APIs, and Linux privilege escalation.
Skill Claude CodeCodex
A reference guide for Web Capture the Flag (CTF) security puzzles, especially PHP weaknesses, injections, file inclusion, source-code discovery, and common flag locations. It focuses on concrete challenge techniques rather than general penetration-testing planning.
Skill Claude CodeCodex
CVE lookup and triage — map discovered services/versions to known CVEs via the cvelookup tool, score by CVSS/exploitability, and prioritize what to verify first.
Skill Claude CodeCodex
A safety wrapper for HackerOne bug-bounty testing that reads a program's allowed targets and rules before handing each allowed asset to a penetration-testing workflow. HackerOne is a platform where companies invite researchers to report security bugs.
Skill Claude CodeCodex
An internal-network penetration-testing guide covering what to do after gaining an initial foothold inside an organization’s network.
Skill Claude CodeCodex
A knowledge guide for open-source intelligence, or OSINT: collecting information from publicly available sources. It covers servers, websites, domains, and, when appropriate, people.
Skill Claude CodeCodex
A Chinese-language quick reference for penetration testing tools, covering reconnaissance, vulnerability testing, password attacks, privilege escalation, and related tasks.
Skill Claude CodeCodex
A Chinese-language quick reference for penetration testing payload families, bypass ideas, and testing order. Penetration testing is authorized security testing that looks for exploitable weaknesses.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized operating system command injection testing, including direct injection, blind injection, out-of-band callbacks, and argument injection. Use when a task belongs to the command injection domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized source code security review, including dangerous function tracing, data-flow analysis, logic flaw detection, and dependency review. Use when a task belongs to the code audit domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized container and orchestration security testing, including Docker escape, Kubernetes privilege escalation, image vulnerabilities, and service mesh bypasses. Use when a task belongs to the container testing domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized CORS misconfiguration testing, including reflected origins, null origins, subdomain trust, and credential exposure. Use when a task belongs to the CORS testing domain and needs scope, evidence, pivot, or exit criteria.
Skill Claude CodeCodex
Domain routing and boundary guidance for authorized cryptography weakness testing, including weak algorithms, padding oracles, key management errors, insecure randomness, and hash collision risks. Use when a task belongs to the cryptography testing domain and needs scope, evidence, pivot, or exit criteria.