Skill Claude CodeCodex
Quick WCAG accessibility scan of any URL. Checks color contrast, missing alt text, keyboard navigation, ARIA labels, heading hierarchy, and focus indicators. Produces a graded report. Uses Playwright MCP only — no signup.
Skill Claude CodeCodex
Defensive review of an LLM/agent application for OWASP-LLM-style risks — prompt injection, unsafe tool calls, excessive agency, and PII/secret leakage. Reads your code, flags issues with file:line. Pure Claude Code, no signup.
Skill Claude CodeCodex
Review a REST/HTTP API — from its OpenAPI spec or route code — for security gaps like missing auth, broken object-level authorization, no rate limiting, and verbose errors. Reports file:line. Pure Claude Code, no signup.
Skill Claude CodeCodex
Find broken links on any website. Crawls the page, checks every link for 404s, redirects, and timeouts. Reports dead links with their location. Uses Playwright MCP only — no signup.
Skill Claude CodeCodex
Profile a cold, cache-empty page load and build a text waterfall — the longest-pole requests, time to first byte, and time to interactive. Flags the critical-path bottlenecks. Playwright MCP only, no signup.
Skill Claude CodeCodex
Rank the most complex code in a repo — long functions, deep nesting, high cyclomatic complexity, and god-files — worst-first, with a refactor suggestion for each. Pure Claude Code, no MCP, no signup.
Skill Claude CodeCodex
Detect JavaScript errors, warnings, and failed network requests on any page. Navigates the URL, collects console output and network failures. Uses Playwright MCP only — no signup.
Skill Claude CodeCodex
Audit a site's cookies and trackers — inventory every cookie, flag missing Secure/HttpOnly/SameSite, list third-party trackers, and detect tracking that fires before consent. Playwright MCP only, no signup.
Skill Claude CodeCodex
Measure Core Web Vitals on any URL — LCP, CLS, INP, TTFB, FCP — using the browser's own performance APIs. Grades each metric against Google's thresholds and produces an A-F report. Playwright MCP only, no signup.
Skill Claude CodeCodex
Find dead code in a repo — unused exports, unreferenced files, unreachable branches, unused imports, and declared-but-unused dependencies. Reports each with file:line and a safe-to-remove confidence. Pure Claude Code, no signup.
Skill Claude CodeCodex
Audit project dependencies for risk — known-vulnerable versions, unpinned ranges, abandoned packages, and badly outdated majors. Reads package.json, requirements.txt, go.mod, Cargo.toml. Pure Claude Code, no signup.
Skill Claude CodeCodex
Review the current git diff for correctness, security, and performance risks before you commit. Produces severity-ranked findings with the exact file:line and a suggested fix. Pure Claude Code — no MCP, no signup.
Skill Claude CodeCodex
Audit a repo (or diff) for weak error handling — swallowed exceptions, bare catches, unhandled promise rejections, missing network timeouts/retries, and errors logged but not surfaced. Pure Claude Code, no MCP, no signup.
Skill Claude CodeCodex
Scan a UI test suite (Playwright, Cypress, Selenium) for brittle locators — nth-child, absolute XPath, text-coupled, and auto-generated class hashes — and suggest stable role/data-test replacements. Pure Claude Code, no signup.
Skill Claude CodeCodex
Probe the forms on a page for validation gaps — missing required-field enforcement, no client-side validation, accepts malformed input, and absent error messaging. Reports per-field findings. Playwright MCP only, no signup.
Skill Claude CodeCodex
Audit a page for internationalization readiness — layout breaks under long translations (pseudo-localization), RTL rendering issues, hardcoded UI strings, and missing lang/dir attributes. Playwright MCP only, no signup.
Skill Claude CodeCodex
Scan infrastructure-as-code — Dockerfiles, Compose, Terraform, and GitHub Actions — for security misconfigurations like running as root, world-writable files, unpinned actions, and hardcoded secrets. Pure Claude Code, no signup.
Skill Claude CodeCodex
Check dependency licenses against your project's license and flag conflicts, copyleft obligations, and unknown/unlicensed packages. Reads manifests directly. Advisory, not legal advice. Pure Claude Code, no signup.
Skill Claude CodeCodex
Scan an HTTPS page for mixed content — HTTP scripts, styles, images, iframes, and insecure form actions. Separates browser-blocked active mixed content from passive, with the exact offending URLs. Playwright MCP, no signup.
Skill Claude CodeCodex
Audit a page's weight against a performance budget — total transfer bytes, request count, render-blocking JS/CSS, and oversized or uncompressed images. Produces a pass/fail budget report. Playwright MCP only, no signup.
Skill Claude CodeCodex
Screenshot any URL at 5 viewport sizes — mobile, tablet, laptop, desktop, and ultrawide. Saves PNGs and reports layout issues. Uses Playwright MCP only — no signup.
Skill Claude CodeCodex
Scan the working tree or git diff for hardcoded secrets — API keys, tokens, private keys, connection strings, cloud credentials — across common providers. Reports file:line with the masked match. Pure Claude Code, no signup.
Skill Claude CodeCodex
Check HTTP security headers on any URL. Grades CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Produces an A-F report with specific missing or misconfigured headers. No signup.
Skill Claude CodeCodex
Quick SEO health check of any URL. Checks meta tags, headings, image alts, structured data, open graph, and common SEO issues. Uses Playwright MCP only — no signup.