Bymax Codex

Plugin bymax-codex in bymaxone/bymax-agent-kit. Commands read from the repo's manifest — 2 days ago.

Skills (61)

• pm

  Engineering Project Manager / TPM for multi-agent development. Turns this session into the coordination layer above independent Claude Code peer sessions: discovers agents (ListAgents), delegates structured task contracts (SendMessage), enforces an evidence-based lifecycle (assign → ack → implement

• babysit-pr

  Autonomously shepherd an open PR to merge-readiness on ANY project — verify the gh CLI is ready, resolve merge conflicts, monitor CI checks at a cadence matched to the CI's real duration (270-second floor), classify failures as real vs flaky (re-running flaky checks), fix real failures locally befor

• continuous-llm-red-teaming-with-promptfoo

  Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking securit

• generating-and-analyzing-sboms

  Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embe

• hardening-docker-containers-for-production

  Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use whe

• implementing-api-key-security-controls

  Implements secure API key generation with sufficient entropy, server-side

• implementing-api-rate-limiting-and-throttling

  Implements API rate limiting and throttling with token bucket, sliding

• implementing-api-schema-validation-security

  Implements API schema validation using OpenAPI Specification and JSON

• implementing-container-image-minimal-base-with-distroless

  Reduces container attack surface by building application images on Google distroless base images that ship only the application runtime - no shell, package manager, or OS utilities - using multi-stage build patterns plus debugging and scanning techniques adapted to distroless. Use when hardening con

• implementing-epss-score-for-vulnerability-prioritization

  Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than

• implementing-gdpr-data-subject-access-request

  Automates GDPR Data Subject Access Request (DSAR) workflows including

• implementing-infrastructure-as-code-security-scanning

  Implements automated security scanning for Infrastructure as Code using

• implementing-llm-guardrails-for-security

  Implements input/output validation guardrails for LLM applications using

• implementing-secret-scanning-with-gitleaks

  This skill covers implementing Gitleaks for detecting and preventing

• implementing-semgrep-for-custom-sast-rules

  Write custom Semgrep SAST rules in YAML to detect application-specific

• implementing-sigstore-for-software-signing

  Implements Sigstore-based software signing and verification using Cosign

• integrating-sast-into-github-actions-pipeline

  Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blocking quality gates for high-severity findings. Use when adding automated code vulnerability detection t

• scanning-docker-images-with-trivy

  Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image duri

• scanning-iac-and-images-with-trivy

  Scans container images, Infrastructure-as-Code (Terraform, CloudFormation,

• securing-agentic-ai-tool-invocation

  Implements defense-in-depth controls at an AI agent's tool-invocation

• securing-github-actions-workflows

  Hardens GitHub Actions workflows against supply chain attacks, credential

• verifying-build-provenance-with-slsa-sigstore

  Verifies artifact signatures and SLSA provenance using Sigstore's

• audit

  Whole-system QA and security audit of a project, run as the Security QA engineer of a peer agent team. Point it at a target: a Jira ticket key (it verifies Jira access first, reads the acceptance criteria, and reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR

• personas

  Persona-based usability QA of an app, run as if real people used it for weeks. It interviews you first (how many personas, iPhone Simulator or Android emulator or browser, how to reach a web app, markets, days to simulate), each question with suggested answers and a recommended one. Then it research

• security-audit

  Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/compr

• security-playbooks

  Defensive security playbooks for the project in front of you, loaded one at a time on demand: harden GitHub Actions, add secret scanning or SAST (Semgrep, CodeQL), scan IaC and container images (Trivy, Checkov), generate SBOMs and verify signatures or SLSA provenance, harden Dockerfiles, add API rat

• tester

  Write tests for a file or component. Detects the project's test stack (Jest/Vitest, React Native/React DOM/pure logic, or Rust cargo test), enforces 100% file coverage, every it() carries a comment, no fake classNames, real branches. Auto-runs tests and verifies coverage on completion.

• standup

  Write the weekly silent-standup report for one repository: a PROGRESS list of what was asked in the period, and UPDATES grouped by area saying what shipped and what it replaced. Every line traces to a pull request, a commit or a request a person typed into a Claude Code or Codex session; nothing is

• autopilot

  Loop-engineering executor — autonomously drive an APPROVED roadmap from first phase to done, one phase per PR, with zero human interaction after launch. An orchestrator session spawns one isolated implementer sub-agent per phase, waits for CI + the review bot via background signals, fixes findings,

• standards

  Universal coding standards reference (TypeScript and Rust tracks) — simplicity ladder (reuse-first / YAGNI, run before writing code), type/lint discipline, naming conventions, doc policy (JSDoc / rustdoc), layered architecture, typed error handling, English-only comments, conventional commits. Load

• bymax-audit

  Audit a scoped system or change with reproducible evidence and independent verification; distinguish static review from authorized live probes.

• bymax-autopilot

  Execute an approved phased roadmap with verified PR gates and supported Codex continuation; also initialize or inspect its state.

• bymax-babysit-pr

  Inspect and shepherd a PR toward merge readiness, repair authorized failures and monitor with available scheduling; never merge.

• bymax-bootstrap

  Set up Bymax project tooling and standards from bundled templates, preserving existing Claude configuration.

• bymax-brainstorm

  Refine an early feature idea, explore alternatives and produce an agreed design brief before planning implementation.

• bymax-checkpoint

  Record implementation progress, decisions and remaining work so a later session can resume the project.

• bymax-code-review

  Review uncommitted changes, branches, commits, PRs or paths using Bymax checks and verified findings. Supports quick, full and deep review; no commit, push or merge.

• bymax-codex-setup

  Check the Codex CLI and Bymax plugin installation and diagnose missing local review prerequisites.

• bymax-personas

  Persona-based usability QA: interview the user (persona count, iPhone Simulator, Android emulator or browser, markets, days), research who would use the app from trusted sources and competitor App Store reviews, write evidence-labelled personas, then use the app as each of them day by day on a pinne

• bymax-phase-tasks

  Expand a roadmap phase into actionable implementation tasks, acceptance checks and agent handoff prompts.

• bymax-plan

  Plan implementation of a single task or feature, with reuse analysis, concrete file changes and validation steps.

• bymax-pm

  Coordinate existing Codex workers with persistent task contracts, acknowledgements and verified project status.

• bymax-push

  Commit and push requested work on a feature branch, respect the staged set, and optionally open a PR when requested.

• bymax-review-md

  Generate REVIEW.md for Anthropic cloud Code Review from project rules; this does not configure Codex review policy.

• bymax-roadmap

  Turn an approved feature specification into a phased roadmap with dependencies, deliverables and a progress dashboard.

• bymax-security-audit

  Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/compr

• bymax-security-playbooks

  Defensive security playbooks for the project in front of you, loaded one at a time on demand: harden GitHub Actions, add secret scanning or SAST, scan IaC and container images, generate SBOMs and verify signatures or SLSA provenance, harden Dockerfiles, add API rate limiting, API key controls or sch

• bymax-sim-android

  Boot an Android emulator and run or reattach the current Expo app using the installed Android SDK.

• bymax-sim-ios

  Boot an available iOS simulator and run or reattach the current Expo app using Xcode tools on macOS.

• bymax-spec

  Write a Bymax feature specification covering user behavior, constraints and acceptance criteria before phased planning.

• bymax-standards

  Apply Bymax TypeScript and Rust conventions when implementing or reviewing code, respecting the target repository policy.

• bymax-standup

  Write the weekly silent-standup report for one repository from evidence: PROGRESS from what was asked in Claude Code and Codex sessions, UPDATES from merged PRs and commits; plain text to paste, no hashes or PR numbers.

• bymax-task

  Execute a selected planned task using Bymax implementation, review and verification workflows.

• bymax-tdd

  Implement a feature or fix with a verified red-green-refactor cycle; use tester for tests of existing behavior.

• bymax-tester

  Write and run tests for a requested file using the detected JavaScript, TypeScript or Rust test stack.

• bymax-upgrade-standards

  Update a project to applicable Bymax standards with a scoped migration and verified quality gates.

• bymax-verify

  Run project quality gates and verify changed behavior against acceptance criteria; distinguish quick static checks from full verification.

• bymax-web-record

  Record a web interaction or verification flow using the supported browser recording tools.

• bymax-web-setup

  Install and smoke-test agent-browser and its browser engine when CLI web verification is requested.

• bymax-web-test

  Run assisted web UI tests with browser, console, network and server evidence where supported by the Codex host.

• bymax-web-verify

  Verify rendered web UI with browser evidence, screenshots and the project's acceptance criteria.