AI Pilot
codexAI Pilot workflow agents: sniper (code quality), research-expert, explore-codebase, websearch
19 skills · 12 commands · hooks
2
codex
Security Expert
Security vulnerability detection and remediation: OWASP Top 10, SAST scanning, CVE research, dependency audit, secrets detection
Plugin security-expert in Fusengine/codex-plugins. Commands read from the repo's manifest — today.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
What it installs
Skills (6)
agentic-securityUse when auditing the security of an AI-coding-agent setup in a repository: Claude Code project settings and hooks, plugin manifests and hooks.json, .mcp.json and MCP servers, skills, agents and rule files, permission rules, secrets in agent configuration, and CI workflows that run an AI agent on pu
auth-auditUse when auditing authentication (JWT, sessions, cookies, OAuth2/OIDC/PKCE, password storage, MFA, account recovery) or authorization (BOLA/IDOR, mass assignment, function-level checks, tenant isolation) in web, API or iOS code.
cve-researchUse when checking a specific dependency or package version for known CVEs and security advisories (OSV, GitHub Advisory, NVD), with CVSS, CWE and reachability verification before anything is reported as a finding.
dependency-auditUse when auditing a project's dependency tree for known vulnerabilities and supply-chain risks (bun/npm/pnpm/yarn, Composer, Cargo, Go modules, SwiftPM, pip, Bundler) and its GitHub Actions workflows. Read-only: reports findings, lists fix commands as options, never applies them.
security-headersUse when auditing HTTP security headers (CSP with nonce/hash and strict-dynamic, HSTS, frame-ancestors, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP), cookie attributes or CORS — in code (Next.js, Laravel, Astro, TanStack Start, Express, Django) or live on a URL the owner names.
security-scanUse when scanning a codebase or a change for XSS, injection, command execution, SSRF, path traversal, weak crypto, hardcoded secrets, insecure deserialization or any OWASP Top 10:2025 vulnerability, and reporting verified findings.
Slash commands (1)
/security-expert:scanLaunch a security audit on the current project (whole repository or a change vs its merge base). Detects vulnerabilities, scans dependencies, checks OWASP Top 10:2025, verifies each finding, and writes a structured report under docs/security/.
Hooks (3)
- PreToolUse
bun "${CODEX_HOME:-$HOME/.codex}/node_modules/@fusengine/harness/dist/cli/bin.mjs" hook codex security
- PostToolUse
bun "${CODEX_HOME:-$HOME/.codex}/node_modules/@fusengine/harness/dist/cli/bin.mjs" hook codex security
- PostToolUse
bun "${CODEX_HOME:-$HOME/.codex}/node_modules/@fusengine/harness/dist/cli/bin.mjs" hook codex security
More from Fusengine/codex-plugins
All 27 plugins →Laravel Expert
codexExpert Laravel latest stable + PHP latest stable with SOLID principles, first-class PHP Attributes, Laravel AI SDK, JSON:API Resources, native vector search (pgvector), Eloquent, Livewire, queues with routing, and comprehensive documentation
23 skills · hooks
2
SEO Expert
codexSEO/GEO 2026 plugin for Codex CLI. Local-first core; optional live Google SERP via Serper (SERPER_API_KEY), framework-aware. Covers technical SEO, schema markup, E-E-A-T, AI Overviews optimization, local SEO, sitemaps, hreflang, internal linking, content briefs, semantic clustering, and search experience optimization.
21 skills · hooks
2
DevOps Expert
codexExpert self-hosted IT/DevOps — Docker, Kubernetes, Linux, Proxmox VE, OpenStack, Terraform/OpenTofu, Ansible, CI/CD, observability, storage and backup, secrets, databases — with a discovery, dry-run, one-go, verify, rollback safety model
18 skills
2
Tailwind CSS Expert
codexExpert Tailwind CSS v4.1 - CSS-first configuration, @theme, @utility, @variant, Oxide engine 5x faster, OKLCH colors, container queries, 15 specialized skills
16 skills · hooks
2
Design Expert
codexDesign Director for websites, web apps, iOS, and Android. Generates HTML/CSS design deliverables with Gemini Design MCP, Magic/21st.dev, and shadcn as optional tools. Mobile targets produce tokens, device-framed mockups, and handoff specs, never SwiftUI/Compose implementation code. Anti-AI-Slop, WCAG 2.2.
10 skills · 5 commands · hooks
2
Similar plugins
ecc
claudecodexHarness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
200 skills · 98 commands · 71 agents · 1 MCP server · hooks
affaan-m/ECC 302,088
security-guidance
claudeSecurity review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
hooks
anthropics/claude-code 155,476
ruflo-federation
claudeCross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails
3 skills · 1 command · 1 agent
ruvnet/ruflo 81,589
Install the "AAS Security Engineer" workflow plugin from Agentic Awesome Skills.
12 skills
sickn33/agentic-awesome-skills 49,620
duende-skills
claudecodexDuende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture
24 skills · 2 agents
anthropics/claude-plugins-official 47,076
security-scanning
claudecodexSAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
5 skills · 3 commands · 2 agents
wshobson/agents 42,461
Maintain Security Expert?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins27 plugins