A Claude Code plugin that reviews web applications for security flaws — architecture recon, 33 vulnerability-class detectors, and a severity-ranked report.
Skill Claude CodeCodex
Use when reviewing a web application for authorization flaws — object IDs or filenames taken from requests, admin or staff routes, role or permission checks, multi-step flows, tenant boundaries — or when asked to find IDOR, privilege escalation, broken access control, or "can user A reach user B's data" issues.
Skill Claude CodeCodex
Use when starting a security review of a web application codebase, when a detection skill reports that architecture.md is missing, or when the codebase has changed enough that the existing architecture summary is stale.
Skill Claude CodeCodex
Use when reviewing a REST or JSON API for surface the front end never exercises — undocumented or legacy endpoints, multiple live versions, catch-all or method-agnostic routes, request bodies bound wholesale onto models or entities, protected properties such as isAdmin or balance reachable through an update, or user…
Skill Claude CodeCodex
Use when reviewing login, registration, logout, password reset or change, remember-me tokens, multi-factor challenges, or session and cookie configuration — or when asked about brute force, account lockout, credential stuffing, username enumeration, 2FA bypass, weak password hashing, forgeable session tokens, or…
Skill Claude CodeCodex
Use when reviewing an application whose rules involve money, quantity, discounts, coupons, limits, quotas, refunds, credits, loyalty points, entitlements, or multi-step flows — or when prices, totals, or eligibility arrive from the client, when one endpoint changes behaviour depending on which parameters are present…
Skill Claude CodeCodex
Use when sensitive pages may be loaded in a frame by another site — no X-Frame-Options, no CSP frame-ancestors, frameguard disabled, @xframeoptionsexempt, frameOptions().disable(), headers set on only some routes — or when one-click state changes, forms prefilled from query parameters, or client-side frame-busting…
Skill Claude CodeCodex
Use when a server sets Access-Control-Allow-Origin from the request Origin, pairs it with Access-Control-Allow-Credentials: true, matches allowed origins with startsWith/endsWith/includes or loose regex, trusts the null origin or an http:// origin, or wildcards authenticated or internal endpoints; also when asked to…
Skill Claude CodeCodex
Use when a codebase hashes passwords, encrypts or decrypts stored data, generates tokens, salts, nonces or session identifiers, compares a signature or a MAC, derives a key from a passphrase, or sets certificate options on an HTTP client — or when asked about weak or missing encryption, ECB mode, reused IVs, insecure…
Skill Claude CodeCodex
Use when state-changing endpoints authenticate with session cookies — email or password change, role updates, transfers, deletions — or when anti-forgery middleware is disabled, exempted or unevenly mounted, tokens are compared against a cookie, Referer checks or method-override parameters appear, or cookies are set…
Skill Claude CodeCodex
Use when the application rebuilds objects from bytes it received — serialized session cookies, hidden form state, cached or queued payloads, uploaded files, binary or type-carrying blobs — or when reviewing native object readers and polymorphic type handling, and when asked to find insecure deserialization, object…
Skill Claude CodeCodex
Use when client-side JavaScript passes URL, document.referrer, window.name, cookie, storage or postMessage data into navigation, cookie, storage, request, socket, parser or DOM-property APIs — location.href, window.open, document.cookie, setRequestHeader, new WebSocket, JSON.parse, document.evaluate, executeSql — or…
Skill Claude CodeCodex
Use when the application accepts files from users — multipart handlers, avatar or attachment endpoints, document and media import, "fetch from URL" imports, archive imports — or when reviewing where uploaded files are stored and served, and when asked to find unrestricted file upload, web shell upload, extension…
Skill Claude CodeCodex
Use when a codebase serves a GraphQL endpoint — schema or SDL files, resolver maps, code-first type definitions, Apollo or similar server setup, a playground, or subscriptions — and especially when introspection or suggestions may be enabled in production, resolvers fetch objects straight from a client-supplied…
Skill Claude CodeCodex
Use when application code builds absolute URLs, password-reset or invitation links, redirects, or email content from the request's host, when forwarded-host or forwarded-scheme headers are honoured, when a proxy routes or names a backend from the client-supplied host, or when asked about reset-link poisoning…
Skill Claude CodeCodex
Use when reviewing error handling, debug or diagnostic endpoints, framework debug flags, server banners, directory listing, what a build copies into a served directory, developer comments or credentials in shipped client code, or responses that differ by internal state — or when asked about leaked stack traces…
Skill Claude CodeCodex
Use when a codebase issues or accepts JSON Web Tokens — bearer credentials, session cookies holding a signed token, identity tokens from a login provider, key-set endpoints, or kid, jwk and jku header handling — or when asked about token forgery, algorithm confusion, alg none, weak signing secrets, or missing claim…
Skill Claude CodeCodex
Use when an application embeds a language model — chat endpoints, model SDK calls, prompt templates, retrieval or document context, agent loops — and especially when untrusted text is concatenated into a prompt, when tools or functions exposed to the model perform real actions or run with service credentials, or when…
Skill Claude CodeCodex
Use when reviewing an application backed by a document or key-value store — MongoDB, Mongoose, Couchbase, DynamoDB, Cassandra, Neo4j — where request JSON or query strings become query filters, where a login compares username and password in a single lookup, or where server-side JavaScript expressions are evaluated, or…
Skill Claude CodeCodex
Use when reviewing social or delegated sign-in, an authorization callback handler, state or nonce handling, redirecturi matching, authorization-code exchange, idtoken consumption, scope enforcement, PKCE, dynamic client registration, or an identity provider — or when asked about account takeover through a third-party…
Skill Claude CodeCodex
Use when reviewing a web application for redirects whose destination comes from the request — next, returnUrl, redirect, url, continue, dest parameters, post-login or post-action return targets, Location headers and framework redirect calls built from user input, allowlists compared with prefix, substring or suffix…
Skill Claude CodeCodex
Use when reviewing code that runs external programs — image or document conversion, PDF generation, archive handling, network diagnostics such as ping or nslookup, backup and maintenance scripts, virus scanning, git or cloud CLI wrappers — or when a request value reaches a shell string, or when asked to find command…
Skill Claude CodeCodex
Use when request data becomes part of a filesystem path — a filename, document key, template name, download or attachment parameter, archive entry, log or export destination — or when reviewing hand-rolled file serving, and when asked to find path traversal, directory traversal, arbitrary file read or write, local…
Skill Claude CodeCodex
Use when JavaScript or Node.js code recursively merges, clones, extends, or path-sets user-controllable objects — query and body parsers with nested key syntax, config merging, deep-copy helpers, option objects with optional fields — or when asked to find prototype pollution, proto injection, polluted inherited…
Skill Claude CodeCodex
Use when reviewing code that checks a condition and then changes state in a separate step — redeeming coupons or gift cards, decrementing stock, transferring funds, enforcing per-user caps or rate limits, creating an object across several statements, or writing session, cache, and database state one field at a time …