← All skills
cxc-dev-security
80 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By lidge-jun/codexclaw (GitHub) · security · 54 stars · scanned at commit e413b14
Use for security and trust boundaries. Triggers: auth, secrets, XSS, CSRF, SQL injection, JWT, OAuth, OWASP, PII, uploads, payments, supply chain, CI integrity, agent security, threat model.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 10 places.
Show 7 more
- plugins/codexclaw/skills/dev-security/references/mcp-supply-chain.md, line 33
| Version pinned | `"@modelcontextprotocol/server-x": "1.2.3"` not `"latest"` | Using `latest`, `*`, or `npx -y` auto-install | - plugins/codexclaw/skills/dev-security/references/mcp-supply-chain.md, line 59
"command": "npx", - plugins/codexclaw/skills/dev-security/references/mcp-supply-chain.md, line 116
"command": "docker", - plugins/codexclaw/skills/dev-security/references/mcp-supply-chain.md, line 155
| `npx -y` for MCP servers | Unpinned, auto-installed, unvetted code runs with agent permissions | Pin version, install explicitly, vet before enabling | - plugins/codexclaw/skills/dev-security/references/mcp-supply-chain.md, line 165
- [ ] No `npx -y` auto-install patterns (§1) - plugins/codexclaw/skills/dev-security/references/owasp-top10.md, line 98
- run: npx license-checker --production - plugins/codexclaw/skills/dev-security/references/static-analysis.md, line 159
- run: python -m pip install pip-audit bandit semgrep
Runs commands on your computer
The author does not mention this. It runs automatically when the plugin is installed. Expected for a security skill.
Found in 43 places.
Show 17 more
- plugins/codexclaw/components/subagent-config/dist/live-catalog.js, line 2
import { execFile } from "node:child_process"; - plugins/codexclaw/components/subagent-config/dist/store.js, line 14
import { spawnSync } from "node:child_process"; - plugins/codexclaw/components/subagent-config/dist/store.js, line 320
return spawnSync( - plugins/codexclaw/components/subagent-config/dist/store.js, line 337
const rootResult = spawnSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], { - plugins/codexclaw/.mcp.json, line 4
"command": "node", - plugins/codexclaw/hooks/_deprecated/post-tool-use-capturing-shell-friction.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook post-tool-use-friction", - plugins/codexclaw/hooks/_deprecated/pre-tool-use-advising-on-friction.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook pre-tool-use-friction", - plugins/codexclaw/hooks/_deprecated/session-start-injecting-project-rules.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook session-start-rules", - plugins/codexclaw/hooks/permission-request-allowing-agent-thread.json, line 7
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook permission-request", - plugins/codexclaw/hooks/post-compact-injecting-bg-terminal-affordance.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/cxc-ops/dist/cli.js\" hook post-compact", - plugins/codexclaw/hooks/post-compact-injecting-bg-terminal-affordance.json, line 20
"command": "node \"${PLUGIN_ROOT}/components/cxc-ops/dist/cli.js\" hook user-prompt-submit", - plugins/codexclaw/hooks/post-compact-injecting-recall-context.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/recall/dist/cli.js\" hook post-compact", - plugins/codexclaw/hooks/post-compact-resetting-reinject-cursor.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook post-compact", - plugins/codexclaw/hooks/post-tool-use-capturing-interview-answers.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook post-tool-use", - plugins/codexclaw/hooks/post-tool-use-tracking-render-observations.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook post-tool-use-render-observation", - plugins/codexclaw/hooks/pre-tool-use-attaching-skills.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/subagent-config/dist/spawn-attach-hook.js\" hook pre-tool-use", - plugins/codexclaw/hooks/pre-tool-use-guarding-automation-ownership.json, line 8
"command": "node \"${PLUGIN_ROOT}/components/pabcd-state/dist/cli.js\" hook pre-tool-use-automation-ownership",
and 23 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'cxc-dev-security' ] || [ -L ~/.agents/skills/'cxc-dev-security' ]; then echo 'A skill folder named cxc-dev-security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/lidge-jun/codexclaw' "$d" && git -C "$d" checkout --quiet 'e413b144ffa0617093d158a0dde101601bcadee9' -- 'plugins/codexclaw/skills/dev-security' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/codexclaw/skills/dev-security' ~/.agents/skills/'cxc-dev-security' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'cxc-dev-security' ~/.claude/skills/'cxc-dev-security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for lidge-jun/codexclaw shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/lidge-jun/codexclaw/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | e413b14 | 80 |