Open-source Attack Surface Management. Discover assets. Identify exposure. Own your security data.
This repository also configures its own agents. See what open-asm tells them →
Skill Claude CodeCodex
How to run security tools on the conversation's worker — built-in tools with executeremotecommand, connector tools with runtoolconnector — and basic shell commands. Load before running any tool or command.
Skill Claude CodeCodex
Perform deep analysis of CVEs and security vulnerabilities including CVSS scoring, affected versions, exploit maturity, and remediation steps. Use when the user needs detailed vulnerability intelligence.
Skill Claude CodeCodex
Perform web research using CVE databases, security advisories, and threat intelligence sources. Use when the user asks about CVEs, security news, vulnerabilities, patch releases, or any external security information not available in the workspace.
Skill Claude CodeCodex
Methodology for safely confirming a suspected vulnerability with a minimal, non-destructive proof and capturing reproducible evidence, then concluding Confirmed / Unconfirmed. Use before reporting a finding or when retesting whether one is still present.
Skill Claude CodeCodex
Methodology for authorized, non-destructive assessment of exposed non-web network services — TLS/SSL posture, SSH, mail, databases, file shares, admin and remote-access ports — for misconfiguration, weak crypto and dangerous exposure. Use when testing open ports and services rather than web apps.
Skill Claude CodeCodex
Methodology for authorized reconnaissance and attack-surface mapping of targets — subdomains, live hosts, ports, technologies and TLS — correlating results with OASM workspace data. Use when enumerating what a target exposes before deeper testing.
Skill Claude CodeCodex
OWASP-aligned methodology for authorized, non-destructive web application security testing — auth, access control, injection, SSRF, misconfiguration and sensitive-data exposure — with safe proofs and evidence capture. Use when assessing a web app or API.
Skill Claude CodeCodex
Drive a real headless browser on the conversation's worker with executeremotecommand and browser ... commands. Covers JavaScript-heavy pages, logins, forms, clicks, tabs, iframes, cookies, storage, console and network logs. Load before testing a web app interactively.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: