Security Codex plugins

Publisher full description

Hide private details before asking ChatGPT for help with a business document. Check the text you'll share, then restore the details in the reply inside Custodis. Open a PDF, text-only Word (.docx) or text (.txt) file inside Custodis, or paste text into its workspace. Add the original there before sharing it in the conversation. Scanned PDF pages are supported; photos and older .doc files are not. Select a hidden detail for Don’t hide or Keep hidden. The…

Publisher full description

Have I Been Squatted finds attacker infrastructure while it is being set up. Lookalike domains, mail servers, staging hosts and their certificates often appear before a phishing campaign launches. This plugin brings detection, investigation and response for them into ChatGPT and Codex. Enr… …s. - Discover: find unregistered lookalikes of a domain that could still be registered defensively. Work your organization's detections - Query: search lookalikes found for your monitored domains, and Email Intelligence and Site Canary events, from the last 30 days. The model reads the field catalog…

Publisher full description

Ask whether an AI agent, MCP server, coding assistant or AI product is safe to use, and get a straight verdict from Greenlit Books, with the setup steps that make it safer and a link to the full review. Each verdict comes from reading the product's own code, docs and settings, and says which version it read and when. There are more than 800 of them, cov… …tside source, the result says what that source does and does not establish. Ask it how or why about working with AI agents and it answers from Greenlit's books: it finds the passage in the free first chapters, the concept pages, the glossary and the claim ledger that bears on your question, quotes i…

Publisher description

Understand a data breach and choose your next steps. Look up a company or website to see known breaches, the types of data exposed, and practical first steps. Browse recent breaches in LeakData's public catalog without connecting an account. Connect your LeakData account to check its verified email address, review existing monitoring results, and work through the most urgent steps first. Ask ChatGPT to guide you through your action plan. When you confirm you finished a step, save it as done; reopen it on request. This records progress in LeakD…

Publisher description

Screenata helps startup founders and CTOs manage security compliance and prepare for SOC 2 Type I and Type II, HIPAA, ISO 27001 and ISO 42001 audits. Assess infrastructure, investigate failing compliance checks, review proposed fixes, verify results, draft security policies from recorded answers, collect evidence and track audit-cycle readiness. Assessments require Screenata sign-in and a selected workspace; new users create their account in the browser.

Publisher full description

Connect an Atbash agent, manage its name, purpose, risk, or active state with browser approval, and check explicitly submitted actions against Atbash safety policies. The desktop helper keeps agent private keys in local configuration and uses them locally for signing. Safety policy enforcement applies to the skill's decision to proceed with an explicitly checked action: HOLD, BLOCK, and errors stop that workflow. This package does not automatically intercept other tool calls or execute submitted commands. Requires Node.js 22.13.0 or newer on macOS arm64, Linux x64/arm64 (glibc), or Windows x64.

Publisher description

Ansvar Systems AB is a Swedish cybersecurity company that gives AI agents verifiable access to law, regulation and security standards. Customers connect the AI assistant they already use (Claude, Microsoft Copilot, ChatGPT or any MCP-compatible client) to the Ansvar Gateway and run compliance work directly in that assistant: regulatory gap analyses, threat models (STRIDE/LINDDUN, TARA), DPIAs and audit preparation, grounded in more than 300 curated corpora of EU and international legislati…

Publisher full description

BlindOracle Agent Trust answers one question before you work with or hire an AI agent: what is its record? What works in ChatGPT today - Trust badge: a one-line badge for an agent name or wallet, built from BlindOracle's audit registry and settlement history. An agent BlindOracle has neve…

Publisher description

AJAXX Data Scrubber in ChatGPT provides read-only information about digital privacy risks and data broker exposure. It explains how personal data appears online, how removal services work, and answers common questions about scans, monitoring, and protection options. This ChatGPT app does not run scans, show personal scan results, perform removals, or manage accounts. For secure ac…

Publisher full description

Inspect repository policy, GitHub Actions trust boundaries, and moderation automation without network access or repository mutation; generate reviewable remediation patches on request.

Publisher full description

Anomity shows a security team every AI tool running on its managed devices: coding agents, MCP servers, skills and instruction files, browser AI use, personal versus corporate AI accounts, and the credentials those tools can reach. Sensors deployed through your device management report that inventory to the Anomity console, where policies turn it into findings. This plu… …e official, community or unknown, how they run, what they can reach, and how many devices use them. Work the allowlist. See what is waiting for approval across AI tools, AI sites, model providers, MCP servers, extensions, plugins and skills. Admins can approve the items they confirm, when an owner h…

Publisher full description

Packaged AppSec workflows for SCA remediation, AI SAST triage, CI/CD posture, malware response, findings review, Endor Labs setup, and more.

Publisher full description

…infrastructure on the internet, like command-and-control servers, malware hosts, phishing kits and attacker directories left open to the web. Connect your Etugen account and you can look all of this up right from the chat. Give it an IP and it tells you which ports are open, which network and country it sits in, what malware runs there, its TLS and JARM fingerprints, how risky it looks and why, and which other hosts share the same certificate or fingerprint. You can also search by malware family, network, country or port, check who registered a domain, or see which ATT&CK techniques have been most active lately. It's made for people who triage alerts, enrich indicators or write up investigations. Access is read-only and follows your Etugen plan…

Publisher full description

…IMTK helps cyber incident managers and response leaders manage active incidents. It provides guided workflows for executive briefings, public communications, incident-response advisory reviews, threat-intelligence requirements, supply-chain incidents, staff-message review and tabletop exercise design. This skills-only plugin works with information supplied by the user and does not connect to external systems or perform technical resp…

Publisher full description

Security and privacy tools for people running AI on their own hardware, plus answers about ArrowMem's privacy design. You can check whether your self-hosted model server is reachable from outside your machine, check whether it still matches the hardening guide, read the live-tested hardening procedure itself, and list the AI tools configured on your machine from config output you paste. You can also ask what ArrowMem is and who op… …and date. A security alert relay can also send a push notice to you or your family. The check tools work only from diagnostic output you paste; they do not connect to your machine or network.

Publisher description

Extend Orca Security's reasoning into ChatGPT. That means every asset, alert, identity, and dependency is already stitched together in Orca’s Unified Data Model before users ask a question. Every answer factors in reachability, blast radius… …mpact from the first response. For teams that want the reasoning without writing the prompts, Orca maintains the AI Skills Hub, an open-source GitHub repo of agent skills. Type "triage alert orca-9012345" and the orca-alert-triage skill handles retrieval, analysis, and formatting. Teams can fork it, modify it, and extend it to their own use cases. The result: security and engineering teams work across cloud, code, and AI from a single workspace, with Orca's reasoning behind every answer.

Publisher description

Safeguard helps users inspect software supply chain risk from ChatGPT, including vulnerabilities, SBOMs, findings, projects, components, policies, guardrails, compliance reports, remediation plans, SCM integrations, notifications, and organization workflows.

Publisher full description

Skarn is a command-line security scanner for AI coding sessions. The audit skill, skarn-audit, teaches the model to run the skarn CLI on this machine and act on what it reports. The skill runs two passes. skarn assess reads the session transcripts that AI coding assistants have already written to disk and reports leaked credentials, prompt injection, exfiltrati… …n remote code or send data off the machine. Both passes run entirely on this machine and make no network call. Neither modifies a session transcript or a configuration file, and every credential value in the output is masked, so a finding names a rule and a masked preview and never the credential it…

Publisher description

Codex Security workflows for security scans, analysis, and investigation.

Publisher full description

Oneleet is a security and compliance platform that runs SOC 2, ISO 27001 and other compliance programs alongside penetration testing, attack surface monitoring, code security and device management. The Oneleet plugin connects ChatGPT and Codex to your Oneleet workspace so you can review and work on your security program in conversation. What you can do: - Compliance: find controls that are failing or not started, read the checks behind a control, and track framework requirements, audit readiness and your compliance journey. - Monitoring: review automated monitors and the assets failing t…

Publisher full description

…uides a step-by-step security scan of Python code with the open-source Frame command-line tool. The workflow checks that the Frame CLI is installed (and points you to the README install steps if it is not, without installing anything itself), runs frame scan, optionally adds the AI layer through a chat-completions endpoint you choose after warning that code snippets are sent to that endpoint, and reads each finding with its CWE ID, location, source and confidence. It separate…

Publisher full description

ScanMalware helps security teams investigate suspicious and phishing URLs. It runs a URL through isolated analysis environments, records what the page loaded and ran, checks it against YARA, antivirus and intrusion-detection rules and threat feeds, has AI models classify suspicious pages by scam type, and keeps public scans in a searchable archive, so one reported phishing pag… …archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data. - Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash, fu…

Publisher description

ProofX protects your digital content with cryptographic signatures. What you can do: - Protect your articles, poems, scripts, code, and text with tamper-proof cryptographic proof - Verify if content is registered with ProofX using a content ID or hash - Look up creator profiles and their protection history - Get digital fingerprints of your content How it works: 1. Connect your ProofX account (free signup at proofx.co.uk) 2. Ask ChatGPT to protect your content 3. Get a verification link anyone can use to prove you created it Used by 300+ creators inclu…

Publisher description

Connect Bastion to ChatGPT to manage your security and compliance posture through natural conversation. Review framework compliance status across SOC 2, ISO 27001, HIPAA, and GDPR. Drill into failing tests, upload evidence, and submit controls for review. Ask your knowledge base security and compliance questions grounded in your own policies and documentation. Monitor code security findings…

Publisher description

Decionis is an execution-authority layer for AI agents. Before an agent takes a consequential action, Decionis evaluates the proposed action against organization policy and determines whether it may proceed, must be held, or requires additional authority. When human approval is required, Decionis can request verifi… …tability. Use Decionis to govern agent-initiated payments, refunds, commerce operations, enterprise workflows, infrastructure changes, and other high-impact actions. Decionis authorizes execution; it does not perform the downstream action. Payments, transfers, trades, orders, and system changes rema…

Publisher description

Assess prompt injection exposure in prompts, AI workflows, retrieved content, and tool designs with evidence-based findings and mitigations.