Loading...
Loading...
Found 239 Skills
Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.
Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence.
Source code security audit using backward taint analysis, slot type classification, render context verification, and 3-phase parallel review producing an exploitation queue.
12 production footguns ranked by severity. Data loss, exploits, memory leaks, mobile perf.
Run a full competitor analysis for an Amazon product. Compares listings, pricing, images, reviews, ratings, and ad presence against direct competitors, finds the weaknesses to exploit and the strengths to neutralize, and outputs a prioritized attack plan. Use when a user asks to analyze competitors, compare their listing to a rival, find a competitor's weak spots, understand why a competitor outranks them, or plan how to beat a specific ASIN. Trigger phrases: "competitor analysis", "analyze my competition", "beat this competitor", "why is this ASIN ranking", "compare my listing". Works with zero tools. the user pastes competitor listing details and reviews.
Ethical hacking and security testing methodologies using penetration testing tools, exploit frameworks, and manual security validation. Use when assessing application security posture and identifying exploitable vulnerabilities.
Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.
Mitigation patterns for privileged-access and governance-adjacent DeFi failures, anchored on the public Drift Protocol incident analysis in Chainalysis’s blog—social engineering, Solana durable nonces, oracle and collateral abuse, multisig governance, and operational monitoring. Use when hardening signer processes, reviewing admin surfaces, or teaching post-incident lessons—not for designing exploits or attributing actors without evidence.
PHP Web Source Code SQL Injection Vulnerability Audit Tool. Identify all SQL execution points from the source code, analyze injection risks, and output exploitability grading, PoC, and repair suggestions (no omissions allowed).
Autonomous white-box AI pentester for web applications and APIs using source code analysis and live exploit execution
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.
Apply the Efficient Market Hypothesis (Fama, 1970) to evaluate information incorporation in asset prices across weak, semi-strong, and strong forms. Use this skill when the user needs to assess market efficiency, determine if a trading strategy can generate abnormal returns, evaluate event studies, or when they ask 'can technical analysis work', 'does the market already know this', or 'is this anomaly exploitable'.