Codex ATTACK

Plugin codex-attack in philo-groves/codex-attack. Commands read from the repo's manifest — 1 month ago.

Skills (13)

• auto-triage

  Build human-friendly, screen-recordable proof-of-concept reproduction kits from already proofed triage-verifier evidence. Use after triage-verifier accepts a finding as proofed, or when Codex needs to turn an agent-focused PoC, proof packet, request log, crash repro, or verifier artifact into direct

• binary-debugging

  Debug authorized binaries, native crashes, core dumps, sanitizer reports, process state, runtime behavior, memory corruption, register state, symbols, dynamic loading, and exploitability evidence using debuggers and tracing tools. Use when Codex needs to inspect ELF/Mach-O/PE executables, shared lib

• binary-reversing

  Reverse engineer authorized binaries and native artifacts through static analysis, disassembly, decompilation, strings, imports, symbols, file formats, firmware contents, protocols, config extraction, patch diffing, obfuscation triage, and security-relevant behavior recovery. Use when Codex needs to

• code-vulnerability-review

  Perform authorized source-code vulnerability review, security patch review, exploitability triage, and remediation planning. Use when Codex needs to inspect codebases, pull requests, diffs, dependencies, configs, tests, or data flows for authn/authz flaws, injection, SSRF, deserialization, crypto mi

• cve-research

  Research CVEs, GHSAs, vendor advisories, affected versions, exploitability, exploitation status, severity, prioritization, mitigations, and remediation guidance from current authoritative vulnerability sources. Use when Codex needs to investigate a CVE or advisory ID, determine whether a product or

• engagement-scope

  Establish authorized engagement context, look up public bounty scope evidence, and route cyber tasks before using specialized skills. Use for any request to model security boundaries, review code vulnerabilities, inspect web or mobile apps, research CVEs, build fuzzers, reverse or debug binaries, or

• exploit-chain-analysis

  Analyze authorized exploit chains by combining tracked findings, confident or proofed issues, and de-escalated leads into higher-impact vulnerability hypotheses. Use when Codex needs to correlate findings, model preconditions and postconditions, consider de-escalated leads as conditional chain edges

• finding-tracker

  Maintain centralized security finding state across authorized cyber workflows. Use when Codex discovers, validates, proofs, de-escalates, updates, searches, deduplicates, summarizes, or hands off potential vulnerabilities, bug bounty findings, audit findings, exploitability leads, crash findings, we

• fuzz-harness-builder

  Selectively design, implement, run, and triage authorized fuzz harnesses for parsers, codecs, protocols, APIs, CLIs, libraries, native boundaries, kernels, and structured inputs when fuzzing is likely to justify its long-running cost. Use when Codex needs to build libFuzzer/AFL++/Honggfuzz/Centipede

• report-writer

  Write submission-ready vulnerability reports, advisory drafts, bounty reports, disclosure notes, remediation summaries, and attachment bundles from proofed findings and verifier evidence. Use when Codex needs to turn finding-tracker IDs, triage-verifier proof packets, auto-triage human PoC kits, exp

• subagent-orchestration

  Plan and coordinate authorized multi-agent cyber workflows with explicit subagent roles, bounded assignments, tracker discipline, debate, deduplication, proof handoffs, and synthesis. Use when the user explicitly asks for subagents, parallel agents, delegation, debate, multiple reviewers, or staged

• triage-verifier

  Verify confident security findings before they are marked proofed. Use when a finding has reached the `confident` state in finding-tracker and the current research chain has ended or plateaued, or when Codex needs to harden, rewrite, reproduce, package, or sanity-check a PoC for a bug bounty, audit,

• web-app-security-inspection

  Perform authorized live or local web application security inspection using browser-visible behavior, HTTP traffic, API calls, authentication and authorization flows, session state, client-side storage, security headers, browser console evidence, and safe runtime validation. Use when Codex needs to i

Hooks (5)

• SessionStart

  python3 "$PLUGIN_ROOT/hooks/codex_attack_context.py" session-start

• PreCompact

  python3 "$PLUGIN_ROOT/hooks/codex_attack_context.py" pre-compact

• PostCompact

  python3 "$PLUGIN_ROOT/hooks/codex_attack_context.py" post-compact

• SubagentStart

  python3 "$PLUGIN_ROOT/hooks/codex_attack_context.py" subagent-start

• SubagentStop

  python3 "$PLUGIN_ROOT/hooks/codex_attack_context.py" subagent-stop

Similar plugins