Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Adapt this C/C++ ASAN vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. Use when the user wants to port, migrate, retarget, customize, or fork the pipeline for something other than C/C++ memory-safety bugs — web apps, smart contracts, deserialization, ML…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Proactive threat hunt over web/application logs — no alert in hand. Profiles the corpus, runs a hypothesis-driven hunt loop with a mandatory written ledger, confirms suspects in source, detonates a local PoC, and writes INCIDENTS.json + INCIDENTREPORT.md. Use when asked to "hunt the logs", "find the campaign", "look…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Incident response workup for a lead in hand — an alert, an IOC, or a /dnr-hunt finding. Scopes the lead across the logs, verdicts whether the attack succeeded, quantifies blast radius, confirms root cause in source with a local PoC, and writes a proposed (never executed) containment/remediation/recovery plan. Use when…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified vuln-pipeline patch ladder; static-analysis input gets a per-finding patch subagent + independent…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…"…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate…
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Verify harness changes end-to-end without docker — drive the real pinned CLI against a header-capturing stub server with the exact env resolveauthenv() produces.
anthropics/defending-code-reference-harness
Skill Claude CodeCodex ✓ vendor
Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when…