Security Codex plugins

Publisher capabilities · listing

Read

Publisher full description

…look all of this up right from the chat. Give it an IP and it tells you which ports are open, which network and country it sits in, what malware runs there, its TLS and JARM fingerprints, how risky it looks and why, and which other hosts share the same certificate or fingerprint. You can also search… …, check who registered a domain, or see which ATT&CK techniques have been most active lately. It's made for people who triage alerts, enrich indicators or write up investigations. Access is read-only and follows your Etugen plan. If we have no record of something, that means we haven't seen it, not…

Publisher full description

…gate suspicious and phishing URLs. It renders a URL in a sandboxed browser, records what the page loaded and did, and keeps public scans in a searchable archive, so one reported phishing page can lead to the rest of its campaign. With this plugin you can: - Look up what the archive already knows about a domain, URL or IP address: the scanner's verdict and risk factors, network requests, indicators, TLS and JARM details, detected technologies, YARA matches, OCR text and RDAP data. - Find related scans by domain, IP, ASN, JARM signature, favicon hash, screenshot hash,…

Publisher full description

…erver is reachable from outside your machine, check whether it still matches the hardening guide, read the live-tested hardening procedure itself, and list the AI tools configured on your machine from config output you paste. You can also ask what ArrowMem is and who operates it, how it handles rete… …The check tools work only from diagnostic output you paste; they do not connect to your machine or network.

Publisher full description

…the skarn CLI on this machine and act on what it reports. The skill runs two passes. skarn assess reads the session transcripts that AI coding assistants have already written to disk and reports leaked credentials, prompt injection, exfiltration attempts, and the chains that connect them; each findi… …run remote code or send data off the machine. Both passes run entirely on this machine and make no network call. Neither modifies a session transcript or a configuration file, and every credential value in the output is masked, so a finding names a rule and a masked preview and never the credential…