Menu
Classifies code vulnerabilities by OWASP Top 10 and CWE identifiers
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Connect the user's Akashi second brain (local, private, verifiable) over MCP and answer from cited vault passages with signed provenance. Query it BEFORE answering anything about the user's knowledge, projects, decisions, or conventions. Triggers - akashi, vault, my notes, second brain, remember this, what did I decide.
Use CodexBar CLI local cost usage to summarize per-model usage for Codex or Claude, including the current (most recent) model or a full model breakdown. Trigger when asked for model-level usage/cost data from codexbar, or when you need a scriptable per-model summary from codexbar cost JSON.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Monitor API health and assert endpoint status with ZK proofs
Semantic code review with provable assertions about code quality
Audit project dependencies with verifiable security assertions
| name | code-security |
| description | Classifies code vulnerabilities by OWASP Top 10 and CWE identifiers |
| type | semantic |
| user-invocable | true |
| semantic | {"skillVersion":1,"permissions":{"graph":["read","write"],"proofs":["request"],"memory":["recall"]},"assertions":[{"predicate":"security:vulnerability","requireProof":true},{"predicate":"security:finding","requireProof":false}],"queries":[{"predicate":"security:history","scope":"agent"}]} |
Classifies code vulnerabilities by OWASP Top 10 categories and CWE identifiers, providing severity ratings for each finding.
Use this skill when:
The skill detects 12 vulnerability classes:
| CWE | Category | Severity |
|---|---|---|
| CWE-89 | SQL Injection | critical |
| CWE-79 | Cross-Site Scripting (XSS) | high |
| CWE-78 | Command Injection | critical |
| CWE-22 | Path Traversal | high |
| CWE-502 | Insecure Deserialization | high |
| CWE-798 | Hardcoded Secrets | critical |
| CWE-95 | Code Injection | critical |
| CWE-918 | Server-Side Request Forgery (SSRF) | high |
| CWE-327 | Weak Cryptography | medium |
| CWE-601 | Open Redirect | medium |
| CWE-209 | Information Exposure | low |
| CWE-306 | Missing Authentication | medium |
skill_assert or other write toolssecurity:finding to trigger the code-security runtimefindings array containing CWE IDs and severity levelssecurity:vulnerability (with proof) to record confirmed vulnerabilitiessecurity:history to review past audit results for the current agent