Skills for your AI
Turns feature requests into structured GitHub issues, epics, PRDs, and hypothesis plans with business context and measurable success criteria. Use when a user requests a feature, needs requirements gathered, wants an issue or epic created, needs prioritization
Reviews code changes for AI/ML bias, accessibility barriers, privacy violations, and ethical risk, producing test reports, fix code, and RAI-ADR documentation. Use when a change involves AI/ML decisions, user-facing features, or personal data handling.
Reviews code for security vulnerabilities using OWASP Top 10, OWASP LLM Top 10, Zero Trust, and reliability checks, producing prioritized findings with vulnerable and secure code examples. Use when asked to security-review code, plan a review, check LLM or API
Reviews system architecture for security, scalability, reliability, cost, and AI-specific concerns using Well-Architected frameworks, and drafts Architecture Decision Records. Use when a user shares a system design, diagram, or architecture description and ask
Produces developer documentation, technical blog posts, tutorials, ADRs, and user guides from technical source material. Use when asked to write, plan, review, or adapt technical content for a specific audience.
Produces Jobs-to-be-Done analysis, user journey maps, Figma-ready user flow descriptions, design principles, and accessibility checklists from user interviews. Use when starting UX research for a product or feature, mapping a user journey, preparing flows for
Searches Google through the Bright Data SERP API and returns structured JSON results with title, link, and description. Use when the user asks to search the web, requests a specific results page, or needs search results formatted as JSON.
Audits and advises on technical SEO, content, schema, performance, AEO/GEO readiness, crawl management, metadata, and off-page authority. Use when a user asks to audit a site's SEO, optimize content for AI citations, add schema markup, fix Core Web Vitals, man
Analyzes a Google Search Console export to find quick SEO wins — striking-distance pages, decaying pages, CTR outliers, cannibalisation, impression leaks and hidden intent — each with a concrete URL and fix. Use when the user asks for quick wins, a traffic-dro
Improves a website's search visibility through keyword research, on-page and technical audits, content, link building, competitor analysis, local SEO, reporting, and strategy. Use when the user asks for SEO keywords, meta tag or page optimization, backlink pla
Forecasts seasonal demand, optimizes stock levels, budgets, supplier communications, promotions, and turnover for seasonal inventory. Use when planning an upcoming season, analyzing multi-year sales patterns, setting stock quantities, drafting supplier message
Pulls cited financial statement figures for US public companies from SEC EDGAR XBRL APIs, with accession numbers, forms, fiscal periods, tags and filing links. Use when the user needs reported revenue, net income, EPS, cash, debt or capex, wants company compar
Turns curriculum topics into complete, differentiated secondary lesson plans with objectives, activities, assessments, and timing. Use when a teacher needs a lesson topic, learning objectives, resources, activities, assessments, differentiation, technology lin
Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), implement secret rotation, or audit secret access patterns.
Guides medical records clerks through HIPAA-compliant encryption, access control, secure transfer, cloud storage, breach response, messaging, audits, training, and policy enforcement. Use when drafting or reviewing secure data sharing practices, policies, or r
Guides secure software development across threat modeling, secure coding review, testing plans, hardening, deployment, documentation, training, incident response, compliance, and cross-cutting security concerns. Use when a cybersecurity analyst needs security
Automate security monitoring, threat detection, incident response, and compliance workflows
Use when Codex should act as the Application Security Engineer specialist from Agency Agents. AppSec specialist who secures the software development lifecycle through threat modeling, secure code review, SAST/DAST integration, and developer security education
Use when Codex should act as the Security Architect specialist from Agency Agents. Expert security architect specializing in threat modeling, secure-by-design architecture, trust-boundary analysis, defense-in-depth, and risk-based security reviews across web,
Guides security architecture consulting work — risk and vulnerability assessment, policy and governance development, framework and compliance assessment, technology evaluation, training, incident response planning, architecture review, solution design and thre
Plans and analyzes security assessments — vulnerability scans, penetration tests, risk assessments, policy reviews, audits, architecture reviews, data classification, incident response, and tool evaluation — producing reports, checklists, and plans. Use when t
Plans, analyzes, and drafts security audit and review reports across vulnerability, configuration, access control, policy, incident response, log, training, physical, vendor, architecture, cloud, continuity, and privacy domains. Use when the user needs audit s
Plans and drafts security awareness training, phishing simulations, policy communications, campaigns, and evaluation surveys for employees. Use when the analyst needs training content, a phishing test, a policy message, a campaign, or a training evaluation.
Reviews code for language and framework specific security vulnerabilities and suggests fixes. Use when the user asks for security guidance, a security review, secure-by-default coding help, or help with authentication, data storage, error handling, security te
