SpecterOps Skills

Reusable agent skills, plugins, and agent definitions for SpecterOps.

Use With Codex

Each plugin includes a Codex manifest at .codex-plugin/plugin.json.

codex plugin marketplace add /Users/<user>/Projects/skills
# or
codex plugin marketplace add SpecterOps/skills

Then open Codex and install from /plugins.

Codex MCP setup

Codex officially supports MCP servers through declarative mcp_servers configuration. This repository no longer ships MCP runner or first-run installer scripts. Install or clone each external MCP server yourself, then point Codex at that server with command, args, and optional env values in ~/.codex/config.toml or project .codex/config.toml.

1. Install or refresh this marketplace in Codex:

   codex plugin marketplace add /Users/<user>/Projects/skills
   # or
   codex plugin marketplace add SpecterOps/skills

   Then install the relevant plugins from /plugins.

2. Configure MCP servers directly in Codex. Example BloodHound and Ghostwriter stdio configurations:

   [mcp_servers.bloodhound_mcp]
   command = "uv"
   args = ["--directory", "/path/to/bloodhound-mcp", "run", "main.py"]
   
   [mcp_servers.bloodhound_mcp.env]
   BLOODHOUND_DOMAIN = "YOUR_DOMAIN"
   BLOODHOUND_TOKEN_ID = "YOUR_TOKEN_ID"
   BLOODHOUND_TOKEN_KEY = "YOUR_TOKEN_KEY"
   BLOODHOUND_SCHEME = "https"
   BLOODHOUND_PORT = "443"
   
   [mcp_servers.ghostwriter]
   command = "uv"
   args = ["--directory", "/path/to/GhostWriterMCP", "run", "python", "-m", "ghostwritermcp.server"]
   
   [mcp_servers.ghostwriter.env]
   GHOSTWRITER_URL = "https://ghostwriter.example.com/"
   GHOSTWRITER_API_KEY = "YOUR_API_KEY"
   GHOSTWRITER_CA_BUNDLE = "/path/to/ca-bundle.crt"
   GHOSTWRITER_OPLOG_ID = "123"
   GHOSTWRITER_OPERATOR = "your-callsign"
   GHOSTWRITER_SOURCE_IP = "10.0.0.5"

3. Configure Binary Ninja MCP with the command or endpoint documented by your BinjaMCP installation. For stdio servers, the Codex shape is:

   [mcp_servers.binary_ninja_mcp]
   command = "npx"
   args = ["-y", "binary-ninja-mcp", "--host", "localhost", "--port", "9009"]

Restart Codex after changing MCP configuration, then confirm the tools appear under /mcp before relying on MCP-assisted skills.

Use With Claude Code

Each plugin lives under plugins/<name>/ and includes a Claude Code manifest at .claude-plugin/plugin.json.

For local development:

/plugin marketplace add /Users/<user>/Projects/skills
/plugin install <plugin-name>@specterops-skills

For a hosted repository:

/plugin marketplace add SpecterOps/skills
/plugin install <plugin-name>@specterops-skills

Use With npx skills

Use npx skills when you only want to install skill instructions. This does not install full plugin behavior such as MCP config, Claude commands, hooks, or agent definitions.

npx skills add SpecterOps/skills --list
npx skills add SpecterOps/skills --skill <skill-name> --agent claude-code --agent codex --global

For local testing:

npx skills add /Users/<user>/Projects/skills --list

Contributing

Start with CONTRIBUTING.md. It covers the supported development environment, setup and validation commands, plugin metadata scaffolding, pull request expectations, and where to ask for help.

Plugins

Plugin	Codex	Claude Code	MCP	Description
workflows-development	Yes	Yes	-	Development scaffolding, repository hygiene, security tooling, and implementation workflows for Specter Codex.
code-review-and-qa	Yes	Yes	-	Code review and web application QA workflows for Specter Codex.
workflows-research	Yes	Yes	-	Source-backed research and synthesis workflows for Specter Codex.
ops-reconnaissance	Yes	Yes	-	Reconnaissance, OSINT, service enumeration, and exposure discovery workflows for Specter Codex.
ops-appsec	Yes	Yes	-	Application and code security assessment workflows for Specter Codex.
ops-sccm	Yes	Yes	-	Microsoft Configuration Manager reconnaissance and takeover validation workflows.
bloodhound	Yes	Yes	Manual	BloodHound, AzureHound, GitHound/JamfHound/OktaHound OpenGraph attack-path query workflows, SCIM bridge references, and optional BloodHound MCP packaging.
payloads	Yes	Yes	-	Reusable Electron payload packaging, persistence, audit, and discovery workflows.
c2-extensions	Yes	Yes	-	Beacon Object File development and reusable C2 extension workflows.
report-drafting	Yes	Yes	Manual	Finding, report drafting, Ghostwriter MCP, and operation log workflows for security assessment deliverables.
reverse-engineering	Yes	Yes	Manual	Reverse engineering workflows and MCP-assisted binary analysis for Binary Ninja, Ghidra, and related tooling.
report-timeline	Yes	Yes	-	Report timeline ingestion, consolidation, and evidence packaging workflows.
codex-observability	Yes	Yes	-	Codex activity reporting and telemetry workflows.
ops-infrastructure	Yes	Yes	-	Infrastructure operations, SSH, tunnel, firewall, and offensive IaC attack-surface workflows.
internal-training-course	Yes	Yes	-	Internal training course wiki migration, scaffolding, content migration, and QA workflows.
social-engineering	Yes	Yes	-	Social engineering research and phishing pretext workflows.
ludus	Yes	Yes	-	Ludus cyber range configuration and management skill with full API, CLI, and deployment references
c2-mythic	Yes	Yes	-	Mythic C2 framework implant and C2 profile development workflows with agent message protocols, payload type definitions, and listener/profile guidance.
tradecraft-windows	Yes	-	-	Windows execution, persistence, and COM proxy validation workflows.
ops-adcs	Planned	-	-	Active Directory Certificate Services assessment and attack-path validation workflows. Planned; no capability is currently packaged.
ops-mssql	Planned	-	-	Microsoft SQL Server reconnaissance, privilege mapping, and assessment workflows. Planned; no capability is currently packaged.
tradecraft-mac	Yes	-	-	macOS execution, persistence, and operator validation workflows.
tradecraft-linux	Yes	-	-	Linux process injection, execution, persistence, and operator validation workflows.
c2-cobaltstrike	Yes	Yes	-	Cobalt Strike Aggressor Script, Sleep, BOF loader, and Malleable C2 profile workflows.
bloodhound-development	Yes	Yes	-	Operate isolated BHE environments, deliver BHE/BHCE changes, and run focused enterprise review and validation workflows.
go-review	Yes	Yes	-	Security review for Go packages and services covering trust boundaries, injection, filesystem, crypto, concurrency, and unsafe/cgo edges
c2-outflankc2	Yes	Yes	-	Outflank C2 (OC2) BOF script and event-driven bot development workflows.

Skills

Skill	Plugin	Path
git-cleanup	workflows-development	SKILL.md
git-merge	workflows-development	SKILL.md
git-preflight	workflows-development	SKILL.md
readme-generation	workflows-development	SKILL.md
scaffold-python	workflows-development	SKILL.md
scaffold-security	workflows-development	SKILL.md
code-review	code-review-and-qa	SKILL.md
cpp-core-guidelines	code-review-and-qa	SKILL.md
webapp-qa	code-review-and-qa	SKILL.md
source-research	workflows-research	SKILL.md
nmap-parse	ops-reconnaissance	SKILL.md
osint-recon	ops-reconnaissance	SKILL.md
shodan	ops-reconnaissance	SKILL.md
secret-scan	ops-appsec	SKILL.md
security-review	ops-appsec	SKILL.md
webapp-review	ops-appsec	SKILL.md
sccm-recon	ops-sccm	SKILL.md
sccm-takeover-relay	ops-sccm	SKILL.md
sccmhunter-install-local	ops-sccm	SKILL.md
azurehound-analysis	bloodhound	SKILL.md
bloodhound-ad-analysis	bloodhound	SKILL.md
bloodhound-analysis	bloodhound	SKILL.md
bloodhound-opengraph	bloodhound	SKILL.md
bloodhound-query	bloodhound	SKILL.md
openhound-development	bloodhound	SKILL.md
openhound-github	bloodhound	SKILL.md
openhound-jamf	bloodhound	SKILL.md
openhound-okta	bloodhound	SKILL.md
electron-app-audit	payloads	SKILL.md
electron-candidate-discovery	payloads	SKILL.md
electron-install-persistence	payloads	SKILL.md
electron-squirrel-repackage	payloads	SKILL.md
beacon-object-file-development	c2-extensions	SKILL.md
c2-bof-development	c2-extensions	SKILL.md
finding-report	report-drafting	SKILL.md
ghostwriter-mcp	report-drafting	SKILL.md
ghostwriter-oplog	report-drafting	SKILL.md
binary-ninja-mcp-analysis	reverse-engineering	SKILL.md
ghidra-mcp-analysis	reverse-engineering	SKILL.md
timeline-asciinema	report-timeline	SKILL.md
timeline-cobaltstrike	report-timeline	SKILL.md
timeline-consolidator	report-timeline	SKILL.md
timeline-ghostwriter	report-timeline	SKILL.md
timeline-markdown-notes	report-timeline	SKILL.md
timeline-mythic	report-timeline	SKILL.md
timeline-pdf-notes	report-timeline	SKILL.md
timeline-workflow	report-timeline	SKILL.md
codex-activity-report	codex-observability	SKILL.md
opentelemetry-codex	codex-observability	SKILL.md
iac-attack-surface	ops-infrastructure	SKILL.md
nftables-allow-source	ops-infrastructure	SKILL.md
proxychains-tunnel	ops-infrastructure	SKILL.md
ssh-ops	ops-infrastructure	SKILL.md
course-wiki-migration-orchestrator	internal-training-course	SKILL.md
course-wiki-stage1-scaffold	internal-training-course	SKILL.md
course-wiki-stage2-content-migration	internal-training-course	SKILL.md
course-wiki-stage3-qa	internal-training-course	SKILL.md
credential-harvest-landing-page-copy	social-engineering	SKILL.md
phishing-campaign-builder	social-engineering	SKILL.md
phishing-email-html	social-engineering	SKILL.md
phishing-pretext	social-engineering	SKILL.md
pretext-brainstormer	social-engineering	SKILL.md
vishing-pretext	social-engineering	SKILL.md
ludus-development	ludus	SKILL.md
mythic-implant-development	c2-mythic	SKILL.md
mythic-profiles	c2-mythic	SKILL.md
mythic-translation-containers	c2-mythic	SKILL.md
com-proxy-triage	tradecraft-windows	SKILL.md
macos-initial-access	tradecraft-mac	SKILL.md
linux-process-injection	tradecraft-linux	SKILL.md
cobalt-strike-aggressor-development	c2-cobaltstrike	SKILL.md
cobalt-strike-aggressor-reference	c2-cobaltstrike	SKILL.md
cobalt-strike-malleable-c2-development	c2-cobaltstrike	SKILL.md
bhe-change-delivery	bloodhound-development	SKILL.md
bhe-dev-bootstrap	bloodhound-development	SKILL.md
bhe-dev-environment	bloodhound-development	SKILL.md
bhe-enterprise-review	bloodhound-development	SKILL.md
bhe-sample-data-ingest	bloodhound-development	SKILL.md
bhe-ui-playwright	bloodhound-development	SKILL.md
go-review	go-review	SKILL.md
oc2-bof-script-development	c2-outflankc2	SKILL.md
oc2-bot-development	c2-outflankc2	SKILL.md

Standalone Skills

Skill	Path
cwe-code-review	SKILL.md
openssf-python-review	SKILL.md
owasp-security-code-review	SKILL.md

Agents

Agent	Path
architect	agents/architect.toml
bloodhound-analyst	agents/bloodhound-analyst.toml
code-reviewer	agents/code-reviewer.toml
course-migration	agents/course-migration.toml
domain-ops	agents/domain-ops.toml
exploit-dev	agents/exploit-dev.toml
internal-network-recon	agents/internal-network-recon.toml
ludus	agents/ludus.toml
mythic-developer	agents/mythic-developer.toml
osint-recon	agents/osint-recon.toml
planner	agents/planner.toml
poc-dev	agents/poc-dev.toml
qa-tester	agents/qa-tester.toml
report-writer	agents/report-writer.toml
researcher	agents/researcher.toml
reverse-engineer	agents/reverse-engineer.toml
sccm-ops	agents/sccm-ops.toml
security-researcher	agents/security-researcher.toml
social-engineer	agents/social-engineer.toml
ssh-operator	agents/ssh-operator.toml
telemetry-analyst	agents/telemetry-analyst.toml
winternals	agents/winternals.toml

MCP-Aware Plugins

MCP Server	Plugin	Configuration
bloodhound_mcp	bloodhound	Configure directly in Codex with uv --directory /path/to/bloodhound-mcp run main.py.
ghostwriter	report-drafting	Configure directly in Codex with uv --directory /path/to/GhostWriterMCP run python -m ghostwritermcp.server.
binary_ninja_mcp	reverse-engineering	Configure directly in Codex with npx -y binary-ninja-mcp --host localhost --port 9009 after installing fosdickio/binary_ninja_mcp in Binary Ninja.
ghidra	reverse-engineering	Configure directly in Codex with the command or endpoint documented by your Ghidra MCP server.