An AI agent for your terminal, built on signal theory: every output is signal, not noise. Codes, runs multi-step work with subagents, and works with any model, including your Claude or ChatGPT subscription.
Skill Claude CodeCodex
Multi-agent red-team campaign orchestration: mission intake with authorization gates, planner/executor separation, objective decomposition into innocuous worker queries, strict-majority verdict adjudication with mandatory cite-checks, and crash-safe mission recovery with idempotent actions. Use when coordinating…
Skill Claude CodeCodex
Engagement report generation for red-team and pentest work: severity-ordered finding sections with verification status badges, evidence snippets with type labels, CVE/CWE cross-references, remediation guidance, mission metadata (status, phases, timestamps), markdown escaping for safe report rendering, and best-effort…
Skill Claude CodeCodex
Run cyber defense attack simulations against isolated lab targets, compare detection gaps, apply a lab patch and rerun to prove defenses work. Use for purple team exercises, simulate attacks, sandbox targets, or test a fix.
Skill Claude CodeCodex
Build and validate cyber defense detection rules with malicious and benign fixtures, telemetry prerequisites and false positive controls. Use for Sigma rules, detection engineering, missing alerts or measuring detection coverage.
Skill Claude CodeCodex
Write, review, and repair Elixir or Erlang code with verified syntax, exact API arities, OTP lifecycle handling, and executable checks. Use for .ex/.exs, mix.exs, GenServer, supervision, Ecto, Phoenix, and BEAM runtime bugs.
Skill Claude CodeCodex
Analyze suspicious email headers and attachments without opening active content, distinguish trusted authentication results and plan mail defenses. Use for phishing triage, email security, spoofed sender or SPF DKIM DMARC evidence.
Skill Claude CodeCodex
Assess host service permissions and defensive configuration, prepare reversible hardening and verify normal behavior plus attack resistance. Use for endpoint hardening, Linux service sandboxing, reducing privileges or securing a workstation.
Skill Claude CodeCodex
Investigate suspected compromise, preserve incident evidence, build a timeline and plan containment, recovery and verification. Use for incident response, account takeover, suspicious host activity or recovery after an attack.
Skill Claude CodeCodex
Normalize and correlate security logs into an evidence-backed timeline while preserving timestamps and parse errors. Use for log analysis, auth failures, event timelines, JSONL triage or suspicious application logs.
Skill Claude CodeCodex
Review network exposure, firewall policy and IDS evidence, then validate defensive changes with permitted and denied traffic controls. Use for network defense, segmentation, Suricata rules, firewall review or packet capture triage.
Skill Claude CodeCodex
Triage suspicious files with static metadata and bounded scanning, and distinguish malware detonation from safe application attack labs. Use for sandbox triage, suspicious attachments, YARA scanning or malware analysis preparation.
Skill Claude CodeCodex
Validate SIEM ingestion, parsing, alert routing and retention with synthetic canaries and timestamp evidence. Use for SIEM operations, missing events, alert pipeline outages, duplicate events or detection delivery checks.
Skill Claude CodeCodex
Investigate a testable cyber defense hypothesis across host, identity and network evidence. Use for threat hunting, hidden persistence, unusual logins or finding adversary behavior without an existing alert.
Skill Claude CodeCodex
Build a concrete cyber defense threat model from assets, data flows and trust boundaries, then map controls to attack simulations and verification. Use for threat modeling, architecture security, abuse cases or designing defenses before deployment.
Skill Claude CodeCodex
Prioritize vulnerabilities using exact affected versions, reachable exposure and known exploitation, then patch and retest with rollback. Use for vulnerability management, patch prioritization, KEV matching, dependency risk or verifying a security fix.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: