Skill Claude CodeCodex
SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.
Skill Claude CodeCodex
SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.
Skill Claude CodeCodex
PHP type juggling and weak comparison (==) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.
Skill Claude CodeCodex
XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.
Skill Claude CodeCodex
XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.
Skill Claude CodeCodex
XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.
Skill Claude CodeCodex
Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.
Skill Claude CodeCodex
Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.
Skill Claude CodeCodex
Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.
Skill Claude CodeCodex
Backend/gateway route traversal playbook. Use when a public parameter (path segment, query param, or header) is concatenated into the path of an internal HTTP request — BFF, API gateway, reverse proxy, or microservice routing — so traversal happens against the backend's route space, not the filesystem.
Skill Claude CodeCodex
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
Skill Claude CodeCodex
Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.
Skill Claude CodeCodex
Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.
Skill Claude CodeCodex
Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.
Skill Claude CodeCodex
Web cache poisoning decision card. Use when response headers show X-Cache/CF-Cache-Status/X-Varnish/Age (CDN, Varnish, CloudFront in front) and the origin reflects X-Forwarded-Host / X-Original-URL / Host or other unkeyed request attributes into generated links, Location, or meta tags. Single home for cache poisoning…
Skill Claude CodeCodex
JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.
Skill Claude CodeCodex
Ghost Bits / Cast Attack — Java char-to-byte narrowing as a WAF/input-filter bypass layer. Use when the backend is Java, a WAF blocks your literal payload, and the sink is a file upload (filename), JSON deserialization, class loader, URL/path decode, header reflection, mail, or Redis/RESP — so you can smuggle a…
Skill Claude CodeCodex
P1 router for the AI-platform / LLM-app attack surface — chatbots and coding-platform backends that expose executable tooling or raw RPC. Use when a target is an AI assistant, agent backend, or coding/IDE platform, and you see tool lists (bash/shell/codeinterpreter), a tenant login + RPC gateway, or a chat endpoint…
Skill Claude CodeCodex
Test AI chat/agent backends that expose an executable tool over a chat endpoint — the "identity endpoint is auth-gated but the chat/tool endpoint is not" class. Use when a whoami/profile endpoint returns 401/unauthenticated yet a /chat / createTask POST still accepts, or when a public page can POST to build a session…
Skill Claude CodeCodex
Test public AI coding-platform / Codex-style consoles: weak-credential or unauth tenant login -> raw RPC (command/exec, fs/, env, meta/methods) -> cluster SA token / model API key chain. Use when a target exposes /tenant-api/login plus /codex-api/rpc (or a tenant-login + RPC-gateway pair), an @openai/codex…
Skill Claude CodeCodex
Whitebox / open-source code-audit and 0day-variant hunting methodology. Use when you actually hold source (the repo, a decompiled jar via cfr, or an OSS dependency) rather than only black-box endpoints — to build a trust model, mine CVE-adjacent variants, and sink-trace to real, exploitable findings. Pairs with the P0…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: