Skill Claude CodeCodex
Focused API security auditor for REST, GraphQL, and webhook endpoints in any stack. Use when the user is building or reviewing an API layer, mentions rate limiting, API keys, webhooks, CORS, or specifically wants "API security" checked — as opposed to a full-project audit.
Skill Claude CodeCodex
Deep-dive auditor for authentication and session management — login, signup, password handling, JWT, OAuth, MFA, password reset, and session lifecycle. Use whenever the user is building or reviewing a login system, password logic, token/session handling, an OTP flow, or an OAuth/SSO integration, for any application in…
Skill Claude CodeCodex
Backend/server-side security auditor for Node.js, Express, NestJS, FastAPI, Django, Flask, Spring, Ruby on Rails, and similar frameworks. Use when reviewing server-side application logic, error handling, logging, file upload handling, or general middleware configuration specifically — separate from database or…
Skill Claude CodeCodex
Cloud and infrastructure configuration security auditor for Vercel, Netlify, AWS, Azure, Google Cloud, and Supabase/Firebase project settings. Use when reviewing deployment configuration, environment variable management, IAM permissions, storage bucket access, or general cloud misconfiguration — rather than the…
Skill Claude CodeCodex
Elite full-codebase security auditor for any language or stack (JavaScript, TypeScript, Python, Java, Kotlin, PHP, Go, Rust, C/C++, Ruby, C#). Trigger this whenever the user asks to review, audit, scan, harden, or "check the security" of any project, before deploying/shipping/launching a site or app, after adding…
Skill Claude CodeCodex
Database security auditor covering PostgreSQL, MySQL, SQL Server, MongoDB, and Supabase/Firebase-style backends. Use when the user asks about database security, Row Level Security (RLS) policies, exposed database access, ORM-related SQL injection, or backend-as-a-service data access rules for any project.
Skill Claude CodeCodex
Dependency and supply-chain vulnerability scanner for npm, pip, composer, gradle, cargo, and other package ecosystems. Use whenever the user wants to check for known CVEs, outdated packages, or supply-chain risk in package.json, requirements.txt, composer.json, build.gradle, Cargo.toml, or similar manifest/lockfiles…
Skill Claude CodeCodex
Frontend/client-side security auditor covering React, Next.js, Vue, and general SPA/SSR concerns — server components, server actions, middleware, cookies, CSP headers, hydration, and client-side XSS. Use when reviewing a frontend application's client-side and edge-runtime security specifically, for any project.
Skill Claude CodeCodex
Defensive triage for suspicious files, scripts, or dependencies the user has already encountered (e.g. a suspicious npm package, an unexpected script in a repo, a file behaving oddly). Use only to identify and explain suspicious behavior in code the user already has, to help them decide whether to remove/report it …
Skill Claude CodeCodex
Structured self-assessment checklist that simulates how a professional security review would probe an application (recon, auth/authorization testing, input testing) for planning and reporting purposes. Use when the user wants a pentest-style checklist or assessment plan for a system they own/operate, or wants to…
Skill Claude CodeCodex
Secure code fixer — takes findings from other security skills (code-audit, vulnerability-scanner, etc.) and implements the actual code fixes safely, preserving functionality, for any language or stack. Use whenever the user asks to fix, patch, or remediate previously identified vulnerabilities directly in their…
Skill Claude CodeCodex
Scans any codebase or repository for hardcoded secrets — API keys, tokens, passwords, private keys, database URLs, cloud credentials. Use whenever the user wants to check for exposed secrets before making a repo public, before a major commit/push, before deployment, or as part of any broader security audit.
Skill Claude CodeCodex
Lightweight secure-code-review checklist for a single pull request, diff, function, or file — as opposed to a full-project audit. Use when the user shares a diff/PR and asks for a review before merge, wants a quick pre-merge security pass, or asks for a secure coding checklist to follow while actively developing a…
Skill Claude CodeCodex
Generates a professional, consolidated security report (Markdown or HTML) from findings produced by other security skills, including an executive summary and an overall security score out of 100. Use at the end of any security audit/scan/pentest-style session, or whenever the user asks for a formal write-up of…
Skill Claude CodeCodex
OWASP Top 10 aligned security scanner for any web application or API, in any language or framework. Use whenever the user wants a standardized OWASP-based scan, mentions "OWASP", "Top 10", "security scan", "pentest checklist", or wants findings organized against the official ten categories with consistent severity…