Skill Claude CodeCodex needs its repo
Triage npm packages for install-script malware, exfiltration, and worming behavior.
not rated 57
+2 14d ago A SkillSpector: warn 27 tokens
original MIT
57Stars on the repository
202Mods indexed here, across every type
14d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
Skill Claude CodeCodex
Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your own model's extractability.
not rated 57
+2 14d ago A SkillSpector: pass 45 tokens
original MIT
Skill Claude CodeCodex
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process…
not rated 57
+2 14d ago A SkillSpector: warn 78 tokens
original MIT
Skill Claude CodeCodex
Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.
not rated 57
+2 14d ago B SkillSpector: warn 31 tokens
original MIT
Skill Claude CodeCodex
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages…
not rated 57
+2 14d ago A SkillSpector: warn 132 tokens
original MIT
Skill Claude CodeCodex
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, OSSGadget, and pypi-scan.
not rated 57
+2 14d ago A SkillSpector: warn 66 tokens
original MIT
Skill Claude CodeCodex needs its repo
Map AWS and Azure attack paths and find exploitable misconfigurations with CloudFox.
not rated 57
+2 14d ago A SkillSpector: pass 24 tokens
original MIT
Skill Claude CodeCodex
Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
not rated 57
+2 14d ago B SkillSpector: warn 37 tokens
original MIT
Skill Claude CodeCodex
Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a…
not rated 57
+2 14d ago A SkillSpector: pass 257 tokens
original MIT
Skill Claude CodeCodex
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
not rated 57
+2 14d ago A SkillSpector: warn 36 tokens
original MIT
Skill Claude CodeCodex
Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.
not rated 57
+2 14d ago A SkillSpector: pass 48 tokens
original MIT
Skill Claude CodeCodex
Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat…
not rated 57
+2 14d ago A SkillSpector: pass 82 tokens
original MIT
Skill Claude CodeCodex
Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response…
not rated 57
+2 14d ago A SkillSpector: pass 76 tokens
original MIT
Skill Claude CodeCodex
Deploy a Velociraptor server and agents and write VQL hunts across a fleet.
not rated 57
+2 14d ago B SkillSpector: warn 28 tokens
original MIT
Skill Claude CodeCodex
Produce and ingest CycloneDX and SPDX SBOMs and correlate them to vulnerability intelligence.
not rated 57
+2 14d ago C 28 tokens
original MIT
Skill Claude CodeCodex
Produce Sigma-based EVTX timelines and summaries with Hayabusa.
not rated 57
+2 14d ago A SkillSpector: pass 26 tokens
original MIT
Skill Claude CodeCodex
Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.
not rated 57
+2 14d ago B SkillSpector: warn 64 tokens
original MIT
Skill Claude CodeCodex
Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for…
not rated 57
+2 14d ago A SkillSpector: pass 64 tokens
original MIT
Skill Claude CodeCodex needs its repo
Perform rapid Sigma and keyword hunting across Windows event logs with Chainsaw.
not rated 57
+2 14d ago A SkillSpector: warn 24 tokens
original MIT
Skill Claude CodeCodex
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download…
not rated 57
+2 14d ago A SkillSpector: pass 102 tokens
original MIT
Skill Claude CodeCodex
Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.
not rated 57
+2 14d ago A SkillSpector: warn 42 tokens
original MIT
Skill Claude CodeCodex
Detect SSO and OAuth token replay and SaaS lateral movement.
not rated 57
+2 14d ago A SkillSpector: warn 23 tokens
original MIT
Skill Claude CodeCodex
Implements strategies to reduce SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness and prevent critical alert dismissal. Use when SOC teams face overwhelming alert volumes, high false…
not rated 57
+2 14d ago A SkillSpector: pass 66 tokens
original MIT
Skill Claude CodeCodex needs its repo
Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.
not rated 57
+2 14d ago A SkillSpector: pass 41 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: