codex-skills/README.md

Andy's Skill Pack

Practical skills for Codex and Claude Code, centred on deep security review and clear project documentation.

Skill	Use it when you need to...
securityaudit	run a deep, evidence-based security audit, generate audit reports, or apply confirmed fixes with --fix.
aitm	create an AITM.md architecture input for automated threat modelling.
debullshit	translate confusing corporate email into clear, British-English, ADHD-friendly plain English.
summarise	create or update a repository SUMMARY.md from code and Git history.

Install for Codex

Paste these into Codex if you prefer installing through $skill-installer:

Use $skill-installer to install https://github.com/andydixon/codex-skills/tree/main/securityaudit
Use $skill-installer to install https://github.com/andydixon/codex-skills/tree/main/aitm
Use $skill-installer to install https://github.com/andydixon/codex-skills/tree/main/debullshit
Use $skill-installer to install https://github.com/andydixon/codex-skills/tree/main/summarise

Restart Codex after installation.

Or install all skills from Terminal on macOS/Linux:

curl -fsSL https://raw.githubusercontent.com/andydixon/codex-skills/main/install.sh | bash

Or from PowerShell on Windows:

powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-RestMethod https://raw.githubusercontent.com/andydixon/codex-skills/main/install.ps1 | Invoke-Expression"

The Codex installer writes skills to ~/.codex/skills.

Install for Claude Code

Install all skills from Terminal on macOS/Linux:

curl -fsSL https://raw.githubusercontent.com/andydixon/codex-skills/main/install-claude.sh | bash

Or from PowerShell on Windows:

powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-RestMethod https://raw.githubusercontent.com/andydixon/codex-skills/main/install-claude.ps1 | Invoke-Expression"

The Claude Code installer writes skills to ~/.claude/skills. Restart Claude Code if it was already open.

Installing Selected Skills

By default, the installer installs all four skills:

securityaudit aitm debullshit summarise

To install only some of them, set SECURITYAUDIT_SKILLS to a space- or comma-separated list before running the script:

export SECURITYAUDIT_SKILLS="securityaudit aitm"
curl -fsSL https://raw.githubusercontent.com/andydixon/codex-skills/main/install.sh | bash

The installers also support SECURITYAUDIT_REPO and SECURITYAUDIT_REF if you need to install from another repository or branch. When run from a local checkout, they install from that checkout instead of downloading from GitHub.

securityaudit

securityaudit is the main skill in this pack. It performs a broad, adversarial application-security review and writes two timestamped reports under audits/:

• YYYYMMDD-HHII-securityAudit.md
• YYYYMMDD-HHII-functionalityNextSteps.md

Use normal audit mode when you want findings and recommendations without application-code changes:

$securityaudit

Claude Code:

/securityaudit

Normal mode may create audits/ and, if the project has no Git repository, may create a conservative initial Git snapshot before auditing. It otherwise avoids modifying application code, configuration, tests, dependencies, or deployment files.

What the audit covers

The updated audit is deliberately deep and sceptical. It reviews:

• attack surface, trust boundaries, roles, entry points, data stores, jobs, webhooks, integrations, and deployment exposure;
• authentication, authorisation, session handling, tenant isolation, business logic, and abuse paths;
• input validation, output encoding, injection risks, SSRF, path traversal, deserialisation, and file processing;
• denial-of-service and resource exhaustion across requests, uploads, queues, retries, database access, caches, parsers, regexes, and background work;
• cryptography, key management, randomness, password storage, TLS, signatures, JWTs, webhook verification, and post-quantum readiness for long-lived confidentiality;
• secrets across their full lifecycle: at rest, in transit, in logs, in config, in process memory, in crash dumps, in heap dumps, in command lines, and in child processes;
• memory safety in native, FFI, Rust unsafe, parser, and allocation-heavy code;
• dependency, supply-chain, CI/CD, container, infrastructure, IAM, RBAC, and deployment configuration risk;
• frontend HTML/JavaScript robustness, including event handlers, async failures, console errors, browser-side storage, DOM XSS, CORS, CSRF, clickjacking, and third-party scripts;
• code-quality problems that increase security, reliability, maintainability, or user-facing breakage risk;
• missing security, abuse-case, boundary, frontend interaction, regression, smoke, and load tests.

Each finding is expected to include severity, confidence, affected files/components, evidence, exploitability, impact, a safe trigger or reproduction where appropriate, a recommended fix, suggested tests, and relevant references such as CWE or OWASP mappings.

Fix mode

Use fix mode only when you want the agent to repair confirmed findings:

$securityaudit --fix

Claude Code:

/securityaudit --fix

Fix mode is intentionally stricter than normal mode. It:

• checks Git state before editing and avoids overwriting unrelated user changes;
• bootstraps a Git repository first if one does not already exist;
• fixes only real, evidence-backed security, DoS, robustness, frontend, or code-quality issues;
• keeps changes as small as practical while preserving existing behaviour;
• adds or updates relevant regression tests where practical;
• runs targeted checks before broader suites when risk warrants it;
• commits successful logical fix groups with security- or robustness-focused commit messages;
• stops for user consent before compatibility-breaking cryptographic migrations.

At the end of a fix run, it should summarise commits created, tests run, findings fixed, findings left open, generated audit files, and residual risk.

aitm

Use aitm when you need a repository architecture document suitable as input to automated threat modelling:

$aitm

Claude Code:

/aitm

It recursively analyses the current project and creates or updates AITM.md. It focuses on components, data flows, actors, trust boundaries, authentication, authorisation, sensitive data, entry points, external integrations, deployment evidence, and uncertainty. It treats the repository as read-only except for AITM.md.

debullshit

Use debullshit for pasted emails that are too corporate, vague, passive-aggressive, over-formal, jargon-heavy, or just unnecessarily hard to parse:

$debullshit
<paste the email here>

Claude Code:

/debullshit
<paste the email here>

It returns the short version, what they actually want, what you need to do, important details, what is vague or missing, and a corporate-to-human rewrite. It preserves names, dates, figures, links, responsibilities, deadlines, nuance, and security warnings. Suspicious payment, credential, link, attachment, MFA, or process-bypass requests are called out near the top.

summarise

Use summarise to generate or update a project summary based on the repository and its Git history:

$summarise

Claude Code:

/summarise

It creates SUMMARY.md by default, or another path if you ask for one. It inspects high-signal project files, Git status, tags, commits, and notable diffs, then writes a management-readable technical narrative without inflating weak evidence into fake certainty.

Installer Behaviour

The install scripts are intentionally defensive:

• install securityaudit, aitm, debullshit, and summarise by default;
• validate each requested SKILL.md name before installing it;
• back up any existing installed skill directory before replacing it;
• install from the local checkout when run inside this repository;
• otherwise download the requested branch from GitHub;
• support SECURITYAUDIT_REPO, SECURITYAUDIT_REF, and SECURITYAUDIT_SKILLS overrides.