Skill Claude CodeCodex
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code. Use when writing login flows, session management, password storage, JWT handling, MFA implementation, credential validation, or any code that authenticates users. Also invoke when implementing…
Skill Claude CodeCodex
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users' resources. Use when writing code that checks authorization, enforces resource ownership, handles IDOR (object-level authorization), processes server-side requests to external URLs, or implements…
Skill Claude CodeCodex
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with…
Skill Claude CodeCodex
Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor…
Skill Claude CodeCodex
Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive…
Skill Claude CodeCodex
Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive data. Use when writing code that encrypts or decrypts data, hashes passwords or tokens, generates random values for security purposes, manages cryptographic keys, or configures TLS/SSL settings. Also…
Skill Claude CodeCodex
Detects forms and state-changing endpoints missing CSRF protection. Use when writing HTML forms that submit POST/PUT/DELETE requests, configuring session cookies, or setting up CSRF middleware for web applications. Also invoke when disabling or bypassing CSRF protections in framework configuration.
Skill Claude CodeCodex
Detects error handlers that leak stack traces or fail open on exception. Use when writing error handlers, exception catching blocks, try/catch/finally constructs, or API error responses. Also invoke when an application could fail open on exception, or when stack traces might reach end users.
Skill Claude CodeCodex
Detects autonomous agents that take irreversible or high-impact actions without human approval. Use when building autonomous LLM agents, implementing multi-step agent pipelines, writing code where LLM output triggers real-world actions (file writes, API calls, emails, database changes, code execution), or designing…
Skill Claude CodeCodex
Detects file upload handlers that accept executable content or write to web- accessible paths without validation. Use when writing file upload handlers, processing multipart form data, saving uploaded files to disk or cloud storage. Also invoke when accepting user-supplied filenames or storing uploads in a…
Skill Claude CodeCodex
Detects GraphQL schemas without depth limits, cost analysis, or introspection controls. Use when writing GraphQL schemas, resolvers, or server configuration. Also invoke when setting up Apollo Server, graphql-yoga, Strawberry, gqlgen, or any GraphQL framework without explicit depth limiting, cost analysis, or…
Skill Claude CodeCodex
Detects API keys, passwords, tokens, and credentials embedded directly in source code. Use when writing code that contains API keys, passwords, tokens, connection strings, or private keys as string literals. Also invoke when embedding credentials in configuration files, environment setup scripts, or test fixtures that…
Skill Claude CodeCodex
Detects HTTP response header construction from user input vulnerable to CRLF injection. Use when writing code that sets HTTP response headers using values from user input, request parameters, or external data. Also invoke when constructing email headers, Content-Disposition filenames, or Location headers from…
Skill Claude CodeCodex
Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.
Skill Claude CodeCodex
Detects SQL, command, and template injection caused by user input reaching an interpreter without parameterization. Use when writing code that constructs database queries, builds SQL strings, executes shell commands, processes templates with user input, evaluates code dynamically, or passes user- controlled data to…
Skill Claude CodeCodex
Detects missing security controls — rate limits, MFA, re-auth — that should have been designed in from the start. Use when designing authentication flows, implementing rate limiting, building business logic for financial or access-sensitive operations, or writing code that enforces security requirements at the…
Skill Claude CodeCodex
Detects sensitive data written to unprotected local files, preference stores, or SQLite. Use when writing code that stores sensitive data (credentials, tokens, PII) to local files, platform preference stores (NSUserDefaults, SharedPreferences, UserDefaults), SQLite databases, or localStorage without encryption at rest.
Skill Claude CodeCodex
Detects unsafe rendering or execution of LLM output that enables XSS, command injection, or second-order injection. Use when writing code that renders LLM output to a UI, executes LLM-generated code or shell commands, or passes LLM responses to downstream APIs or databases. Also invoke when displaying markdown or HTML…
Skill Claude CodeCodex
Detects LLM tool definitions without parameter validation, allowing prompt injection to escalate into file/shell/network access. Use when writing LLM tool definitions, function schemas for tool use, plugin or extension handlers, or any code that defines what actions an LLM can take via tools. Also invoke when…
Skill Claude CodeCodex
Detects unsafe deserialization, unverified software updates, and tampered CI artifacts. Use when writing deserialization code, processing pickled or marshalled data, implementing software update mechanisms, consuming CI/CD artifact downloads, or handling data from untrusted sources that gets reconstructed into objects.
Skill Claude CodeCodex
Detects IPC receivers that accept input without verifying caller identity. Use when writing URL scheme handlers, Android intent receivers or exported activities, named pipe or socket listeners, XPC service handlers, or any IPC endpoint that processes caller-supplied input without validating the caller's identity or…
Skill Claude CodeCodex
Detects compromised or backdoored models loaded from unverified sources, floating tags, or unreviewed registries. Use when writing code that downloads pre-trained models, loads models from registries or file paths, integrates third-party LLM providers, or manages model version selection. Also invoke when setting up…
Skill Claude CodeCodex
Detects missing security event logs, logged secrets, and log injection through user input. Use when writing logging code, audit trails, error handlers that log, authentication event recording, or any code that writes security- relevant events. Also invoke when logging user inputs, API responses, or system actions that…
Skill Claude CodeCodex
Detects ORM create/update calls that spread request bodies without an explicit field allowlist. Use when writing code that creates or updates database records from request body, form data, or JSON input. Also invoke when spreading, merging, or destructuring request payloads directly into ORM model create/update calls…