Skills for your AI
Use when Codex should act as the Penetration Tester specialist from Agency Agents. Offensive security specialist conducting authorized penetration tests, red team operations, and vulnerability assessments across networks, web applications, and cloud infrastruc
Plans authorized web application penetration tests from codebase analysis, producing a detailed pentest-plan.md with test cases tied to real code, endpoints, and config. Use when the user requests a pentest plan, security assessment plan, or attack surface rev
Drafts, reviews, aligns, and implements organizational security policies against standards and regulations. Use when researching policy best practices, building policy frameworks, drafting policy documents, reviewing existing policies, mapping policies to GDPR
Assesses and mitigates security risks across systems, vendors, and processes, producing risk registers, control assessments, policy reviews, incident response plans, and compliance reports. Use when the user needs vulnerability scanning, threat modeling, risk
Use when Codex should act as the Senior SecOps Engineer specialist from Agency Agents. Defensive application security specialist who scans every code submission for secrets and sensitive data exposure before anything else, then implements or audits security co
Guides users through security threats, fixes, and protective measures with step-by-step instructions. Use when a user reports malware symptoms, needs firewall, password, phishing, patching, encryption, backup, Wi-Fi, mobile, or antivirus help.
Guides cybersecurity analysts through planning and configuring security technologies such as firewalls, VPNs, IDS, SIEM, DLP, endpoint protection, email gateways, WAFs, vulnerability management, MFA, SOC/SOAR, and encryption. Use when an analyst asks for step-
Plans and reviews security testing work — vulnerability assessment, penetration testing, code and architecture review, threat modeling, compliance, tool evaluation, patch management, training, incident response, authentication, encryption, mobile and cloud sec
Use when Codex should act as the Threat Detection Engineer specialist from Agency Agents. Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting, alert tuning, and detection-as-code pipelines for security
Identifies and mitigates security threats through vulnerability assessment, log and malware analysis, threat intelligence, incident response, network traffic analysis, threat modeling, policy review, and security awareness work. Use when a cybersecurity analys
Use when Codex should act as the Threat Intelligence Analyst specialist from Agency Agents. Cyber threat intelligence specialist who tracks adversary groups, maps attack campaigns to MITRE ATT&CK, produces actionable intelligence reports, and builds detection
Produces an evidence-based Markdown threat model for a repository or path, covering system model, trust boundaries, assets, entry points, attacker calibration, prioritized threats, and mitigations. Use when asked to threat model a repo, service, or path, or to
Customizes security tools (firewall, SIEM, endpoint, IDPS, encryption, access control) to an organization's infrastructure and risk profile, producing comparisons, rules, integration and validation plans, documentation, and response playbooks. Use when evaluat
Builds cybersecurity training programs, awareness campaigns, phishing simulations, policy communications, incident reporting materials, and assessments for any employee audience. Use when the user needs a training module, campaign package, phishing simulation,
Identifies, assesses, and tracks security vulnerabilities across code, networks, and policies, producing prioritized findings, threat models, compliance reports, and remediation plans. Use when asked to scan code or infrastructure, design penetration test scen
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enf
Scans code for security vulnerabilities, assesses their severity, checks compliance against security standards, and consults reference material. Use when a user asks to scan a project directory, assess vulnerabilities in a path, run a compliance check, or look
Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the right specialist skill (pen-testing, incident response, cloud posture, red team,
Runs threat modeling, security audits, penetration tests, and security architecture, cryptography, and best-practices guidance on projects. Use when the user asks to threat model, audit, pentest, or review a project's security, or asks about security patterns,
Analyzes server metrics and infrastructure data to recommend performance, caching, load balancing, database, security, power, and disaster recovery optimizations. Use when a systems administrator asks to analyze server performance, design load balancing, plan
Audits web applications for session management vulnerabilities, including fixation, logout invalidation, persistence after password change, refresh token rotation, entropy, JWT sessions, cookie attributes, and DBSC downgrade. Use when the user wants to test se
Hunts Microsoft SharePoint Server on-prem farms for anonymous endpoint exposure, version disclosure, legacy SOAP login bypass, ToolShell preconditions, SafeControl enumeration, NTLM topology leaks, custom-branding modules, and EoL permanent-CVE windows. Use wh
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugin
/cs:soc2-audit-prep <scope> — SOC 2 Type II readiness 6-question forcing interrogation. Observation-period focused. Use before Type II observation begins, mid-period checkpoint, or pre-field-test month-10 readiness.
