Skill Claude CodeCodex
Detects LLM prompts built from user input or retrieved documents that let attackers hijack the model's instructions. Use when writing code that constructs LLM prompts from user input, builds system prompts, implements RAG pipelines, or processes external documents fed to a model. Also invoke when external data can…
Skill Claude CodeCodex
Detects JavaScript deep-merges or property assignment from user input that can pollute Object.prototype. Use when writing JavaScript or TypeScript code that deep-merges, clones, or extends objects using user-controlled input. Also invoke when using lodash merge/set, Object.assign with dynamic keys, or recursive…
Skill Claude CodeCodex
Detects check-then-act sequences on shared state vulnerable to TOCTOU manipulation. Use when writing check-then-act sequences on shared state, file operations that check existence before read/write, balance updates without locking, or any code where two operations on the same resource are not atomic.
Skill Claude CodeCodex
Detects RAG pipelines that ingest external documents into LLM context without sanitization or trust gating. Use when building RAG pipelines, ingesting external documents into vector stores, or retrieving content from external sources to include in LLM context. Also invoke when writing code that fetches URLs or parses…
Skill Claude CodeCodex
Detects regex patterns vulnerable to catastrophic backtracking on crafted inputs. Use when writing regular expressions that will be applied to user- supplied input. Also invoke when compiling regexes from external configuration, building input validation patterns, or parsing untrusted strings with regex.
Skill Claude CodeCodex
Applies fixes for security findings produced by /security-review. Use when the user wants to fix security issues found by /security-review or when they ask to clean up, remediate, or apply fixes for security findings.
Skill Claude CodeCodex
Detects insecure defaults, overly permissive CORS, exposed debug endpoints, and missing security headers. Use when writing server configuration, setting environment variables, configuring CORS policies, enabling debug modes, setting up default credentials, or deploying application infrastructure. Also invoke when…
Skill Claude CodeCodex
Runs a full OWASP/CWE security audit via isolated subagents. Use when the user types /security-review or explicitly requests a full security audit of the current code.
Skill Claude CodeCodex
Detects PII, credentials, and secrets passed to LLM APIs or embedded in system prompts. Use when writing code that passes sensitive data (PII, credentials, health data) to an LLM API, constructs system prompts containing secrets, returns LLM responses that could contain training data, or implements memory/context…
Skill Claude CodeCodex
Detects HTTP requests to user-controlled URLs that can reach internal services or cloud metadata endpoints. Use when writing code that makes HTTP requests to URLs constructed from user input, fetches resources from caller-specified addresses, or proxies requests on behalf of users. Also invoke when implementing…
Skill Claude CodeCodex
Detects supply-chain risks in dependency manifests, lockfiles, install commands, and CI pipelines — missing lockfiles, absent vulnerability scanners, unverified installs, install hooks that pipe remote content to a shell, and AI-hallucinated package names. Use when writing package install commands, dependency…
Skill Claude CodeCodex
Produces a threat model — purpose, deployment, trusted inputs, untrusted inputs — for a new feature or component before it's implemented. Use when writing an implementation plan for a new API endpoint, data pipeline, agent loop, or system component. Also invoke when a plan introduces new trust boundaries, handles…
Skill Claude CodeCodex
Detects user input passed to LLMs without Unicode normalization, allowing RTL overrides, zero-width joiners, and homoglyph attacks. Use when writing code that passes user-supplied strings to an LLM, constructs prompts from external data, or processes text that may contain Unicode control characters, homoglyphs, or…