Security skills for Codex
Skills for defensive security and authorized testing: OWASP Top 10 and API reviews, penetration testing methodology with scope and rules of engagement, threat modeling, SAST with Semgrep and CodeQL, dependency, container and secret scanning, web hardening such as CSP and security headers, incident response and audit reports.
curl -fsSL codexskills.dev/install.sh | sh -s -- --category security Installs all 45 into ~/.agents/skills/. Or download the zip.
All 45 Security skills
Each opens the full SKILL.md, example prompts and every way to install it.
-
Active Directory Assessment
Fewer, longer paths to Domain Admins -
API Security Testing
Prove BOLA with two tokens -
Authentication Security
Close every side door into the account -
Bug Bounty Reporting
Reports triagers reproduce in five minutes -
Burp Suite Workflows
Repeater and Intruder, one variable at a time -
Cloud Security Posture
Rank by exposure, fix the top ten -
CodeQL Analysis
Taint tracking source to sink -
Container Scanning
Fix the base, not one CVE at a time -
Content Security Policy
Strict CSP without breaking checkout -
CORS Configuration
Fix the CORS error without opening the API -
Cryptography Usage
Right primitive, right library, nothing homemade -
CSRF Protection
Forged requests die at the middleware -
CTF Crypto Challenges
Name the broken assumption, script the solve -
CTF Web Challenges
Understand the app, then find the intended bug -
Dependency Scanning
Triage CVEs to fixes, not alert counts -
File Upload Security
Uploads that never run, render or overflow -
GDPR Privacy Engineering
Know every copy of personal data, and delete it -
Security Incident Response
Contain fast, keep the evidence, mind the clock -
Log Forensics
Every conclusion backed by a log line -
Malware Triage
A safe verdict without ever running it -
Mobile App Security
Treat the app binary as attacker-owned -
Nmap Scanning
Right flags, honest reading of output -
OAuth Security Review
Catch the takeover before it ships -
OWASP Top 10 Review
Find real OWASP bugs at file:line -
Password Storage
Argon2id now, legacy MD5 rows gone for good -
Pentest Methodology
Scope, exploit, document, report -
Recon and OSINT
Turn a target into a scoped inventory -
Secret Scanning
Rotate first, then purge history -
Secrets in CI
Short-lived OIDC over long-lived keys -
Secure Code Review
Security review of a diff, done right -
Security Audit Report
Findings an engineer can fix and an exec can read -
Security Headers
Every response, every header, one layer -
Security Logging
Logs that answer who, what, where, when -
Semgrep SAST
A ruleset you trust, gated on new bugs -
SOC 2 Controls
Controls systems enforce, evidence that pulls itself -
SQL Injection Prevention
Bind every value, allowlist every column -
SSRF Prevention
Check the IP you connect to, not the URL -
Supply Chain Security
Install what you reviewed, ship what you can prove -
Threat Modeling
STRIDE threats tied to real data flows -
TLS Hardening
TLS 1.2+ with AEAD only, proven by a scan -
Token Security
Keys you can detect, scope, rotate and kill -
Vulnerability Disclosure
Be easy to report to, and answer on time -
WAF Rules
Count first, block later, except narrowly -
Web App Pentest
WSTG coverage with an evidence trail -
XSS Prevention
Encode for the sink, not for the input
No Security skill matches that.
Where to start
Install the ones that match requests you make every week. Name one with $authentication-security when you want it for sure; otherwise Codex picks by description.
Start with
- Authentication SecurityClose every side door into the account
- OWASP Top 10 ReviewFind real OWASP bugs at file:line
- Active Directory AssessmentFewer, longer paths to Domain Admins
Install a few by name
curl -fsSL codexskills.dev/install.sh | sh -s -- active-directory-assessment api-security-testing 104-line POSIX script. No sudo, no telemetry. Read install.sh
By stack
In collections
Security FAQ
How do I install every Security skill at once?
Run curl -fsSL https://codexskills.dev/install.sh | sh -s -- --category security to put all 45 in ~/.agents/skills/, or add --project to install them into the current repository's .agents/skills/. You can also download the category zip and unpack it yourself.
Does installing 45 skills slow Codex down?
Hardly. At startup Codex sees only each skill's name and description, a few dozen words apiece, and reads a full SKILL.md only when a task needs it. Install the whole category if the work fits; unused skills cost almost nothing.
Which Security skill should I start with?
Start with Authentication Security, OWASP Top 10 Review, Active Directory Assessment. They cover the requests that come up most in this category. Mention one with $authentication-security to try it.