Skill Claude CodeCodex
Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.
Skill Claude CodeCodex
Detects SQL, command, and template injection caused by user input reaching an interpreter without parameterization. Use when writing code that constructs database queries, builds SQL strings, executes shell commands, processes templates with user input, evaluates code dynamically, or passes user- controlled data to…
Skill Claude CodeCodex
Detects missing security controls — rate limits, MFA, re-auth — that should have been designed in from the start. Use when designing authentication flows, implementing rate limiting, building business logic for financial or access-sensitive operations, or writing code that enforces security requirements at the…
Skill Claude CodeCodex
Detects sensitive data written to unprotected local files, preference stores, or SQLite. Use when writing code that stores sensitive data (credentials, tokens, PII) to local files, platform preference stores (NSUserDefaults, SharedPreferences, UserDefaults), SQLite databases, or localStorage without encryption at rest.
Skill Claude CodeCodex
Detects unsafe rendering or execution of LLM output that enables XSS, command injection, or second-order injection. Use when writing code that renders LLM output to a UI, executes LLM-generated code or shell commands, or passes LLM responses to downstream APIs or databases. Also invoke when displaying markdown or HTML…
Skill Claude CodeCodex
Detects LLM tool definitions without parameter validation, allowing prompt injection to escalate into file/shell/network access. Use when writing LLM tool definitions, function schemas for tool use, plugin or extension handlers, or any code that defines what actions an LLM can take via tools. Also invoke when…
Skill Claude CodeCodex
Detects unsafe deserialization, unverified software updates, and tampered CI artifacts. Use when writing deserialization code, processing pickled or marshalled data, implementing software update mechanisms, consuming CI/CD artifact downloads, or handling data from untrusted sources that gets reconstructed into objects.
Skill Claude CodeCodex
Detects IPC receivers that accept input without verifying caller identity. Use when writing URL scheme handlers, Android intent receivers or exported activities, named pipe or socket listeners, XPC service handlers, or any IPC endpoint that processes caller-supplied input without validating the caller's identity or…
Skill Claude CodeCodex
Detects compromised or backdoored models loaded from unverified sources, floating tags, or unreviewed registries. Use when writing code that downloads pre-trained models, loads models from registries or file paths, integrates third-party LLM providers, or manages model version selection. Also invoke when setting up…
Skill Claude CodeCodex
Detects missing security event logs, logged secrets, and log injection through user input. Use when writing logging code, audit trails, error handlers that log, authentication event recording, or any code that writes security- relevant events. Also invoke when logging user inputs, API responses, or system actions that…
Skill Claude CodeCodex
Detects ORM create/update calls that spread request bodies without an explicit field allowlist. Use when writing code that creates or updates database records from request body, form data, or JSON input. Also invoke when spreading, merging, or destructuring request payloads directly into ORM model create/update calls…
Skill Claude CodeCodex
Detects MCP tool handlers vulnerable to malicious inputs, hardcoded secrets, or unrestricted file/shell access. Use when writing MCP server definitions, tool schemas, or tool handler code. Also invoke when registering tools with Claude or building Claude Code extensions that expose file system, shell, or network…
Skill Claude CodeCodex
Detects function-local misuse of memory and resource APIs in C, C++, and Rust unsafe — allocations whose return value is not checked, frees on error paths that race the success path, locks initialized incorrectly, file descriptors leaked across exec. Use when writing or modifying C or C++ code that calls…
Skill Claude CodeCodex
Detects LLM endpoints missing token caps, rate limits, or prompt-length bounds, enabling cost and resource exhaustion. Use when writing LLM API call handlers, setting up inference endpoints, implementing chatbot backends, or configuring token limits for LLM services. Also invoke when accepting user- provided prompts…
Skill Claude CodeCodex
Detects inference endpoints without authentication or throttling, allowing model weight reconstruction. Use when writing inference API endpoints, deploying LLM-serving infrastructure, implementing model access controls, or configuring rate limiting and authentication for model endpoints.
Skill Claude CodeCodex
Detects agent-to-agent calls without authentication, authorization, or permission scoping. Use when writing code that calls other agents, spawns subagents, builds multi-agent pipelines, or passes messages between LLM agents. Also invoke when an orchestrator delegates tasks to worker agents or when agents share tools…
Skill Claude CodeCodex
Detects MongoDB and other NoSQL queries that mix user input into operators or filters without validation. Use when writing MongoDB queries, Elasticsearch queries, or other NoSQL database operations that include user-supplied input. Also invoke when building query filters from request parameters or constructing…
Skill Claude CodeCodex
Detects untrusted numeric input that flows through a conversion, cast, or parser into a length, size, index, or authorization comparison without bounds-checking the post-conversion value. Use when writing or modifying code that calls atoi/strtol/parseInt/strconv.Atoi on user-supplied or network-supplied input, casts…
Skill Claude CodeCodex
Detects weak JWT validation, loose redirecturi matching, and missing state parameters in OAuth/OIDC flows. Use when writing OAuth2 or OpenID Connect flows, JWT validation logic, token endpoint handling, or redirect URI processing. Also invoke when implementing any code that parses or verifies JWTs.
Skill Claude CodeCodex
Detects redirects to user-controlled URLs that enable phishing and OAuth callback abuse. Use when writing code that redirects users to a URL from request parameters, form input, or any caller-controlled source. Also invoke when building login flows with "return to" URLs or OAuth callback redirects.
Skill Claude CodeCodex
Detects systems that treat LLM output as authoritative fact in consequential decisions without human review. Use when writing code that displays LLM output as authoritative fact, uses LLM decisions to gate consequential outcomes without human review, or builds automated pipelines where LLM judgment drives downstream…
Skill Claude CodeCodex
Detects file operations with user-controlled paths vulnerable to ../ traversal, absolute paths, or symlink escapes. Use when writing code that opens, reads, writes, or deletes files using paths constructed from user input. Also invoke when serving static files, handling file downloads by name, or resolving paths from…
Skill Claude CodeCodex
Lightweight per-PR security gate that detects Critical and High severity OWASP/LLM issues in changed files only. Use when scanning a small git diff in CI for blocking findings. Single-pass; does not dispatch subagents and does not perform threat modeling or attack-chain analysis.
Skill Claude CodeCodex
Detects unsafe privilege handling in SUID/SGID binaries, environment-variable trust in privileged code, insecure umask, temp-file races, and symlink-follow bugs in /tmp. Use when writing or modifying SUID/SGID-installed code, code that drops or elevates privileges via setuid/setgid/seteuid/seteuidr, anything that…