MMCPMarkets
YC

ypyik0669/ctf-codex

Developer tools

This page was translated automatically. Technical details may differ from the original. View the original

63 stars Quality 54 Trend 17MIT
Repository Install

Community security audit skills for Codex: used for authorized CTF, pre-launch security checks, project hardening, and AI security report compilation

Overview

This is a Codex security audit skill package released to the community. It organizes Codex into workflows suitable for authorized security analysis, pre-launch security checks, CTF/range analysis, and AI security report compilation. If your goal is a project you own, maintain yourself, own by your team, or have already received explicit authorization, this Skill can help conduct more systematic security checks, focusing on identifying the issues that should be fixed first before going live. - Inspect publications such as Web, API, backend, mobile apps, desktop apps, browser plugins, CLI, SDKs, containers, cloud deployments, CI/CD, npm/pip packages - Check for leaks of sensitive information such as API Keys, database connection strings, payment keys, JWT Secrets, cloud keys, etc. - Check for obvious security flaws in login, permissions, unauthorized exceedance, tenant isolation, object ownership, and backend interfaces - Check whether payments, subscriptions, points, licenses, and rights may be forged or bypassed by the client - Check whether frontend packages, app packages, desktop or plugins bring out undisclosed keys, debug interfaces, source maps, internal logic - Perform proof-path analysis of authorization CTFs, test ranges, and question assets - Organize AI security vulnerabilities, agent tool boundary issues, prompt injection impact reports - Review code from a defensive perspective, such as OWASP Top 10, XSS, SQL injection, IDOR, logic overreach, input validation, parametric queries, etc Important note: This Skill is only applicable to those you own, maintain, participate in, authorize, or have explicitly permitted testing by rules. It is not intended to attack third parties, bypass platform security checks, hide attack intent, bypass authorizations, or steal data. - Git installed - Codex CLI or Codex Desktop is installed If the terminal prompts that the ctf command cannot be found, please add ~/.local/bin to PATH, or use the following directly: - ~/.codex/skills/ctf/: The true Codex skill, called with $ctf - ~/.codex/prompts/ctf.md:Slash prompt, called with /prompts:ctf - ~/.codex/instructions/instruction.ctf.md:Profile-level model command - ~/.codex/ctf.config.

Overview (machine translated)

This is a Codex security audit skill package released to the community. It organizes Codex into workflows suitable for authorized security analysis, pre-launch security checks, CTF/range analysis, and AI security report compilation.

If your goal is a project you own, maintain yourself, own by your team, or have already received explicit authorization, this Skill can help conduct more systematic security checks, focusing on identifying the issues that should be fixed first before going live.

Suitable scenarios include:

  • Check publications such as Web, API, backend, mobile apps, desktop apps, browser plugins, CLI, SDKs, containers, cloud deployments, CI/CD, npm/pip packages, etc
  • Check for leaks of sensitive information such as API Keys, database connection strings, payment keys, JWT Secrets, cloud keys, etc
  • Check for obvious security flaws in login, permissions, unauthorized access, tenant isolation, object ownership, and backend interfaces
  • Check whether payments, subscriptions, points, licenses, and benefits could be forged or bypassed by the client
  • Check whether frontend packages, app packages, desktop versions, or plugins contain keys, debugging interfaces, source maps, or internal logic that should not be disclosed
  • Perform proof-path analysis of authorized CTFs, test ranges, and subject assets
  • Organize AI security vulnerabilities, agent tool boundary issues, and prompt injection impact reports
  • Review code from a defensive perspective, such as OWASP Top 10, XSS, SQL injection, IDOR, logic privilege overreach, input validation, parametric queries, etc

Important note: This Skill is only applicable to those you own, maintain, participate in, authorize, or have explicitly permitted testing by rules. It is not intended to attack third parties, bypass platform security checks, hide attack intent, bypass authorizations, or steal data.

What can this skill do?

It mainly offers three modes:

Mode Purpose
MODE=release-audit Conduct a security check for your project before launch, prioritizing identifying real issues that could cause losses
MODE=ctf Conduct authorized CTF/range / question asset analysis, pursuing reproducible proof path
MODE=safety-bounty Organize AI security vulnerabilities, agent boundary issues, and responsible disclosure reports

The most commonly used daily are:

Installation

Prerequisites:

  • Git installed
  • Codex CLI or Codex Desktop is installed

Windows PowerShell

After installation, restart Codex.

macOS / Linux

After installation, restart Codex.

If the terminal prompts that the ctf command cannot be found, please add ~/.local/bin to PATH, or simply use:

What do you get after installation?

The installation script will copy the file to the Codex configuration directory:

  • ~/.codex/skills/ctf/: The true Codex skill, called with $ctf.
  • `~/.

This page was translated automatically. Technical details may differ from the original.

Recommended Tools

Try a different keyword or remove a filter.

Install

npx skillfish add ypyik0669/ctf-codex
New to MCP? Start with the mcpskill.org guide →