
पुन: प्रयोग योग्य आक्रामक सुरक्षा कौशल और AI एजेंटों के लिए प्लगइन्स, जो Windows, Linux, macOS और क्लाउड में रिकॉनिसेंस, एक्सप्लॉइटेशन, C2, पेलोड विकास और रिपोर्टिंग को कवर करते हैं।
SpecterOps के लिए पुन: प्रयोज्य एजेंट कौशल, प्लगइन्स और एजेंट परिभाषाएँ।
प्रत्येक प्लगइन में .codex-plugin/plugin.json पर एक Codex मैनिफेस्ट शामिल है।```bash
codex plugin marketplace add /Users//Projects/skills
codex plugin marketplace add SpecterOps/skills
फिर Codex खोलें और `/plugins` से इंस्टॉल करें।
### Codex MCP सेटअप
Codex आधिकारिक तौर पर घोषणात्मक `mcp_servers` कॉन्फ़िगरेशन के माध्यम से MCP सर्वरों का समर्थन करता है। यह रिपॉज़िटरी अब MCP रनर या पहली बार चलाने वाली इंस्टॉल स्क्रिप्ट के साथ नहीं आती है। प्रत्येक बाहरी MCP सर्वर को स्वयं इंस्टॉल या क्लोन करें, फिर `~/.codex/config.toml` या प्रोजेक्ट `.codex/config.toml` में `command`, `args`, और वैकल्पिक `env` मानों के साथ Codex को उस सर्वर की ओर इंगित करें।
1. इस मार्केटप्लेस को Codex में इंस्टॉल या रीफ़्रेश करें: ```bash
codex plugin marketplace add /Users/<user>/Projects/skills
# or
codex plugin marketplace add SpecterOps/skills
फिर /plugins से संबंधित प्लगइन्स इंस्टॉल करें।
MCP सर्वरों को सीधे Codex में कॉन्फ़िगर करें। BloodHound और Ghostwriter stdio कॉन्फ़िगरेशन का उदाहरण: ```toml [mcp_servers.bloodhound_mcp] command = "uv" args = ["--directory", "/path/to/bloodhound-mcp", "run", "main.py"]
[mcp_servers.bloodhound_mcp.env] BLOODHOUND_DOMAIN = "YOUR_DOMAIN" BLOODHOUND_TOKEN_ID = "YOUR_TOKEN_ID" BLOODHOUND_TOKEN_KEY = "YOUR_TOKEN_KEY" BLOODHOUND_SCHEME = "https" BLOODHOUND_PORT = "443"
[mcp_servers.ghostwriter] command = "uv" args = ["--directory", "/path/to/GhostWriterMCP", "run", "python", "-m", "ghostwritermcp.server"]
[mcp_servers.ghostwriter.env] GHOSTWRITER_URL = "https://ghostwriter.example.com/" GHOSTWRITER_API_KEY = "YOUR_API_KEY" GHOSTWRITER_CA_BUNDLE = "/path/to/ca-bundle.crt" GHOSTWRITER_OPLOG_ID = "123" GHOSTWRITER_OPERATOR = "your-callsign" GHOSTWRITER_SOURCE_IP = "10.0.0.5"
अपने BinjaMCP इंस्टॉलेशन द्वारा प्रलेखित कमांड या एंडपॉइंट के साथ Binary Ninja MCP को कॉन्फ़िगर करें। stdio सर्वरों के लिए, Codex आकार इस प्रकार है: ```toml [mcp_servers.binary_ninja_mcp] command = "npx" args = ["-y", "binary-ninja-mcp", "--host", "localhost", "--port", "9009"]
Codex को MCP कॉन्फ़िगरेशन बदलने के बाद रीस्टार्ट करें, फिर MCP-सहायता प्राप्त स्किल्स पर भरोसा करने से पहले पुष्टि करें कि टूल्स /mcp के अंतर्गत दिखाई दे रहे हैं।
प्रत्येक प्लगइन plugins/<name>/ के अंतर्गत रहता है और इसमें .claude-plugin/plugin.json पर एक Claude Code मैनिफेस्ट शामिल होता है।
स्थानीय विकास के लिए:```text /plugin marketplace add /Users//Projects/skills /plugin install @specterops-skills
एक होस्टेड रिपॉजिटरी के लिए:```text
/plugin marketplace add SpecterOps/skills
/plugin install <plugin-name>@specterops-skills
npx skills का उपयोग तब करें जब आप केवल skill निर्देश स्थापित करना चाहते हैं। यह पूर्ण प्लगइन व्यवहार जैसे MCP कॉन्फ़िग, Claude कमांड, हुक, या एजेंट परिभाषाएँ स्थापित नहीं करता है।```bash
npx skills add SpecterOps/skills --list
npx skills add SpecterOps/skills --skill --agent claude-code --agent codex --global
स्थानीय परीक्षण के लिए:```bash
npx skills add /Users/<user>/Projects/skills --list
CONTRIBUTING.md से शुरू करें। यह समर्थित विकास परिवेश, सेटअप और सत्यापन कमांड, प्लगइन मेटाडेटा स्कैफोल्डिंग, पुल अनुरोध अपेक्षाओं, और सहायता कहाँ माँगनी है, को कवर करता है।
| Skill | Path |
|---|---|
cwe-code-review | SKILL.md |
| Plugin | Codex | Claude Code | MCP | Description |
|---|
| workflows-development | Yes | Yes | - | Development scaffolding, repository hygiene, security tooling, and implementation workflows for Specter Codex. |
| code-review-and-qa | Yes | Yes | - | Code review and web application QA workflows for Specter Codex. |
| workflows-research | Yes | Yes | - | Source-backed research and synthesis workflows for Specter Codex. |
| ops-reconnaissance | Yes | Yes | - | Reconnaissance, OSINT, service enumeration, and exposure discovery workflows for Specter Codex. |
| ops-appsec | Yes | Yes | - | Application and code security assessment workflows for Specter Codex. |
| ops-sccm | Yes | Yes | - | Microsoft Configuration Manager reconnaissance and takeover validation workflows. |
| bloodhound | Yes | Yes | Manual | BloodHound, AzureHound, GitHound/JamfHound/OktaHound OpenGraph attack-path query workflows, SCIM bridge references, and optional BloodHound MCP packaging. |
| payloads | Yes | Yes | - | Reusable Electron payload packaging, persistence, audit, and discovery workflows. |
| c2-extensions | Yes | Yes | - | Beacon Object File development and reusable C2 extension workflows. |
| report-drafting | Yes | Yes | Manual | Finding, report drafting, Ghostwriter MCP, and operation log workflows for security assessment deliverables. |
| reverse-engineering | Yes | Yes | Manual | Reverse engineering workflows and MCP-assisted binary analysis for Binary Ninja, Ghidra, and related tooling. |
| report-timeline | Yes | Yes | - | Report timeline ingestion, consolidation, and evidence packaging workflows. |
| codex-observability | Yes | Yes | - | Codex activity reporting and telemetry workflows. |
| ops-infrastructure | Yes | Yes | - | Infrastructure operations, SSH, tunnel, firewall, and offensive IaC attack-surface workflows. |
| internal-training-course | Yes | Yes | - | Internal training course wiki migration, scaffolding, content migration, and QA workflows. |
| social-engineering | Yes | Yes | - | Social engineering research and phishing pretext workflows. |
| ludus | Yes | Yes | - | Ludus cyber range configuration and management skill with full API, CLI, and deployment references |
| c2-mythic | Yes | Yes | - | Mythic C2 framework implant and C2 profile development workflows with agent message protocols, payload type definitions, and listener/profile guidance. |
| tradecraft-windows | Yes | - | - | Windows execution, persistence, and COM proxy validation workflows. |
| ops-adcs | Planned | - | - | Active Directory Certificate Services assessment and attack-path validation workflows. Planned; no capability is currently packaged. |
| ops-mssql | Planned | - | - | Microsoft SQL Server reconnaissance, privilege mapping, and assessment workflows. Planned; no capability is currently packaged. |
| tradecraft-mac | Yes | - | - | macOS execution, persistence, and operator validation workflows. |
| tradecraft-linux | Yes | - | - | Linux process injection, execution, persistence, and operator validation workflows. |
| c2-cobaltstrike | Yes | Yes | - | Cobalt Strike Aggressor Script, Sleep, BOF loader, and Malleable C2 profile workflows. |
| bloodhound-development | Yes | Yes | - | Operate isolated BHE environments, deliver BHE/BHCE changes, and run focused enterprise review and validation workflows. |
| go-review | Yes | Yes | - | Security review for Go packages and services covering trust boundaries, injection, filesystem, crypto, concurrency, and unsafe/cgo edges |
| c2-outflankc2 | Yes | Yes | - | Outflank C2 (OC2) BOF script and event-driven bot development workflows. |
| Skill | Plugin | Path |
|---|
git-cleanup | workflows-development | SKILL.md |
git-merge | workflows-development | SKILL.md |
git-preflight | workflows-development | SKILL.md |
readme-generation | workflows-development | SKILL.md |
scaffold-python | workflows-development | SKILL.md |
scaffold-security | workflows-development | SKILL.md |
code-review | code-review-and-qa | SKILL.md |
cpp-core-guidelines | code-review-and-qa | SKILL.md |
webapp-qa | code-review-and-qa | SKILL.md |
source-research | workflows-research | SKILL.md |
nmap-parse | ops-reconnaissance | SKILL.md |
osint-recon | ops-reconnaissance | SKILL.md |
shodan | ops-reconnaissance | SKILL.md |
secret-scan | ops-appsec | SKILL.md |
security-review | ops-appsec | SKILL.md |
webapp-review | ops-appsec | SKILL.md |
sccm-recon | ops-sccm | SKILL.md |
sccm-takeover-relay | ops-sccm | SKILL.md |
sccmhunter-install-local | ops-sccm | SKILL.md |
azurehound-analysis | bloodhound | SKILL.md |
bloodhound-ad-analysis | bloodhound | SKILL.md |
bloodhound-analysis | bloodhound | SKILL.md |
bloodhound-opengraph | bloodhound | SKILL.md |
bloodhound-query | bloodhound | SKILL.md |
openhound-development | bloodhound | SKILL.md |
openhound-github | bloodhound | SKILL.md |
openhound-jamf | bloodhound | SKILL.md |
openhound-okta | bloodhound | SKILL.md |
electron-app-audit | payloads | SKILL.md |
electron-candidate-discovery | payloads | SKILL.md |
electron-install-persistence | payloads | SKILL.md |
electron-squirrel-repackage | payloads | SKILL.md |
beacon-object-file-development | c2-extensions | SKILL.md |
c2-bof-development | c2-extensions | SKILL.md |
finding-report | report-drafting | SKILL.md |
ghostwriter-mcp | report-drafting | SKILL.md |
ghostwriter-oplog | report-drafting | SKILL.md |
binary-ninja-mcp-analysis | reverse-engineering | SKILL.md |
ghidra-mcp-analysis | reverse-engineering | SKILL.md |
timeline-asciinema | report-timeline | SKILL.md |
timeline-cobaltstrike | report-timeline | SKILL.md |
timeline-consolidator | report-timeline | SKILL.md |
timeline-ghostwriter | report-timeline | SKILL.md |
timeline-markdown-notes | report-timeline | SKILL.md |
timeline-mythic | report-timeline | SKILL.md |
timeline-pdf-notes | report-timeline | SKILL.md |
timeline-workflow | report-timeline | SKILL.md |
codex-activity-report | codex-observability | SKILL.md |
opentelemetry-codex | codex-observability | SKILL.md |
iac-attack-surface | ops-infrastructure | SKILL.md |
nftables-allow-source | ops-infrastructure | SKILL.md |
proxychains-tunnel | ops-infrastructure | SKILL.md |
ssh-ops | ops-infrastructure | SKILL.md |
course-wiki-migration-orchestrator | internal-training-course | SKILL.md |
course-wiki-stage1-scaffold | internal-training-course | SKILL.md |
course-wiki-stage2-content-migration | internal-training-course | SKILL.md |
course-wiki-stage3-qa | internal-training-course | SKILL.md |
credential-harvest-landing-page-copy | social-engineering | SKILL.md |
phishing-campaign-builder | social-engineering | SKILL.md |
phishing-email-html | social-engineering | SKILL.md |
phishing-pretext | social-engineering | SKILL.md |
pretext-brainstormer | social-engineering | SKILL.md |
vishing-pretext | social-engineering | SKILL.md |
ludus-development | ludus | SKILL.md |
mythic-implant-development | c2-mythic | SKILL.md |
mythic-profiles | c2-mythic | SKILL.md |
mythic-translation-containers | c2-mythic | SKILL.md |
com-proxy-triage | tradecraft-windows | SKILL.md |
macos-initial-access | tradecraft-mac | SKILL.md |
linux-process-injection | tradecraft-linux | SKILL.md |
cobalt-strike-aggressor-development | c2-cobaltstrike | SKILL.md |
cobalt-strike-aggressor-reference | c2-cobaltstrike | SKILL.md |
cobalt-strike-malleable-c2-development | c2-cobaltstrike | SKILL.md |
bhe-change-delivery | bloodhound-development | SKILL.md |
bhe-dev-bootstrap | bloodhound-development | SKILL.md |
bhe-dev-environment | bloodhound-development | SKILL.md |
bhe-enterprise-review | bloodhound-development | SKILL.md |
bhe-sample-data-ingest | bloodhound-development | SKILL.md |
bhe-ui-playwright | bloodhound-development | SKILL.md |
go-review | go-review | SKILL.md |
oc2-bof-script-development | c2-outflankc2 | SKILL.md |
oc2-bot-development | c2-outflankc2 | SKILL.md |
openssf-python-review | SKILL.md |
owasp-security-code-review | SKILL.md |
| Agent | Path |
|---|
architect | agents/architect.toml |
bloodhound-analyst | agents/bloodhound-analyst.toml |
code-reviewer | agents/code-reviewer.toml |
course-migration | agents/course-migration.toml |
domain-ops | agents/domain-ops.toml |
exploit-dev | agents/exploit-dev.toml |
internal-network-recon | agents/internal-network-recon.toml |
ludus | agents/ludus.toml |
mythic-developer | agents/mythic-developer.toml |
osint-recon | agents/osint-recon.toml |
planner | agents/planner.toml |
poc-dev | agents/poc-dev.toml |
qa-tester | agents/qa-tester.toml |
report-writer | agents/report-writer.toml |
researcher | agents/researcher.toml |
reverse-engineer | agents/reverse-engineer.toml |
sccm-ops | agents/sccm-ops.toml |
security-researcher | agents/security-researcher.toml |
social-engineer | agents/social-engineer.toml |
ssh-operator | agents/ssh-operator.toml |
telemetry-analyst | agents/telemetry-analyst.toml |
winternals | agents/winternals.toml |
| MCP Server | Plugin | Configuration |
|---|
bloodhound_mcp | bloodhound | Configure directly in Codex with uv --directory /path/to/bloodhound-mcp run main.py. |
ghostwriter | report-drafting | Configure directly in Codex with uv --directory /path/to/GhostWriterMCP run python -m ghostwritermcp.server. |
binary_ninja_mcp | reverse-engineering | Configure directly in Codex with npx -y binary-ninja-mcp --host localhost --port 9009 after installing fosdickio/binary_ninja_mcp in Binary Ninja. |
ghidra | reverse-engineering | Configure directly in Codex with the command or endpoint documented by your Ghidra MCP server. |