Skills, prompts, AGENTS.md files and MCP servers that Codex reads. Skills are shared with Claude Code; the rest is Codex-native. 282,036 indexed, measured the same four ways as everything else here.
Clean Architecture audit for Go services. Use when reviewing layered architecture, dependency rules, or gRPC/usecase/repository patterns. Ensures proper separation of concerns and dependency inversion.
Use when performing threat modeling for a project, feature, or system architecture. Applies STRIDE threat categorization with DREAD risk rating to produce structured threat models in OTM JSON and markdown formats. Covers system decomposition, trust boundary mapping, data flow analysis, per-subsystem threat…
Battle-tested Playwright E2E testing patterns for Next.js/React apps. Use when writing, running, debugging, or fixing Playwright tests. Also triggers on 'e2e', 'end-to-end', 'playwright', 'browser test', 'UI test', 'integration test with browser', 'flaky test', 'test keeps failing'. Covers locators, assertions…
Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document…
Security audit of LLM system prompts, agent instruction files (SKILL.md, AGENTS.md, CLAUDE.md), and agent configurations against prompt injection attacks. Use when the user wants to (1) audit or harden a system prompt or agent instructions against prompt injection, (2) review an agent skill or system prompt for…
Review an implemented product UI or public prose surface for hard visual defects, design-system incoherence, repeated template patterns, and AI-writing tells without treating subjective taste as universal law. Use for pre-ship screenshots, browser review, README/tool-page copy, launch notes, guide prose, or redesigns…
Use s-gw when working with credentials, private keys, API tokens, SSH identities, browser credentials, or other sensitive data in agentic coding workflows. Prefer typed handles and local approved execution over exposing raw secret values to a model.
Select and connect the right vector-store backend for the vector-mcp MCP server — chromadb, postgres/pgvector, qdrant, couchbase, or mongodb — and supply the correct dbtype/connection parameters that every collection and search call needs. Use when the agent must decide which engine to target, wire up…
Use when auditing a web app for security vulnerabilities. Triggers on: 'audit my project', 'how could this get hacked', 'find bugs in this codebase', 'security review', 'pentest', 'bug bounty scope for X', 'GHSA collaborator invite', 'security audit this'. Handles both internal audits (sitting in your own codebase…
Use Oz for version-aware external library, SDK, framework, API, and package documentation before Context7 or web search. Trigger for questions about external packages, APIs, libraries, SDKs, frameworks, versions, config keys, CLI flags, or code examples.
Use when answering biomedical research questions that need source-backed evidence from local MCP servers, including gene, disease, drug, variant, phenotype, study, or clinical-trial questions.
This skill gives agents access to the main headlines of many newspapers and news sites, across 20 countries, via a public API. The API has two modes: a live mode, updated in near real-time, and an archive mode that lets you fetch the headlines from a given moment in time. In both modes, the endpoint returns a JSON…
AgentVeil action-control workflows for AI agent systems. Evaluate risky actions with Runtime Gate, route human approvals, resume approved execution, fetch signed receipts, inspect agent public profiles, check advisory reputation, submit signed attestations, discover agents by capability, and verify audit evidence…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: