specterops/skillsReusable offensive security skills and plugins for AI agents, covering reconnaissance, exploitation, C2, payload development, and reporting across Windows, Linux, macOS, and cloud.
Reusable agent skills, plugins, and agent definitions for SpecterOps.
Each plugin includes a Codex manifest at .codex-plugin/plugin.json.
codex plugin marketplace add /Users/<user>/Projects/skills
# or
codex plugin marketplace add SpecterOps/skills
Then open Codex and install from /plugins.
Codex officially supports MCP servers through declarative mcp_servers configuration. This repository no longer ships MCP runner or first-run installer scripts. Install or clone each external MCP server yourself, then point Codex at that server with command, args, and optional env values in ~/.codex/config.toml or project .codex/config.toml.
Install or refresh this marketplace in Codex:
codex plugin marketplace add /Users/<user>/Projects/skills
# or
codex plugin marketplace add SpecterOps/skills
Then install the relevant plugins from /plugins.
Configure MCP servers directly in Codex. Example BloodHound and Ghostwriter stdio configurations:
[mcp_servers.bloodhound_mcp]
command = "uv"
args = ["--directory", "/path/to/bloodhound-mcp", "run", "main.py"]
[mcp_servers.bloodhound_mcp.env]
BLOODHOUND_DOMAIN = "YOUR_DOMAIN"
BLOODHOUND_TOKEN_ID = "YOUR_TOKEN_ID"
BLOODHOUND_TOKEN_KEY = "YOUR_TOKEN_KEY"
BLOODHOUND_SCHEME = "https"
BLOODHOUND_PORT = "443"
[mcp_servers.ghostwriter]
command = "uv"
args = ["--directory", "/path/to/GhostWriterMCP", "run", "python", "-m", "ghostwritermcp.server"]
[mcp_servers.ghostwriter.env]
GHOSTWRITER_URL = "https://ghostwriter.example.com/"
GHOSTWRITER_API_KEY = "YOUR_API_KEY"
GHOSTWRITER_CA_BUNDLE = "/path/to/ca-bundle.crt"
GHOSTWRITER_OPLOG_ID = "123"
GHOSTWRITER_OPERATOR = "your-callsign"
GHOSTWRITER_SOURCE_IP = "10.0.0.5"
Configure Binary Ninja MCP with the command or endpoint documented by your BinjaMCP installation. For stdio servers, the Codex shape is:
[mcp_servers.binary_ninja_mcp]
command = "npx"
args = ["-y", "binary-ninja-mcp", "--host", "localhost", "--port", "9009"]
Restart Codex after changing MCP configuration, then confirm the tools appear under /mcp before relying on MCP-assisted skills.
Each plugin lives under plugins/<name>/ and includes a Claude Code manifest at .claude-plugin/plugin.json.
For local development:
/plugin marketplace add /Users/<user>/Projects/skills
/plugin install <plugin-name>@specterops-skills
For a hosted repository:
/plugin marketplace add SpecterOps/skills
/plugin install <plugin-name>@specterops-skills
Use npx skills when you only want to install skill instructions. This does not install full plugin behavior such as MCP config, Claude commands, hooks, or agent definitions.
npx skills add SpecterOps/skills --list
npx skills add SpecterOps/skills --skill <skill-name> --agent claude-code --agent codex --global
For local testing:
npx skills add /Users/<user>/Projects/skills --list
Start with CONTRIBUTING.md. It covers the supported development environment, setup and validation commands, plugin metadata scaffolding, pull request expectations, and where to ask for help.