bounty-hunting-programs

Claude Code and Codex Skills for Software Correctness
Formal verification, model checking, security auditing, proof repair, and benchmarking — as slash commands.

Contents

• Quick Start
• Codex User-Level Install
• Codex Workspace Install
• Plugins
  • fuzzer — Coverage-guided fuzzing for C/C++, Rust, and Go
  • kage — Local pentest sandbox in a per-engagement Kali container
  • kani-proof — Model checking for Rust and Solana
  • evm-protocol-audit — Protocol-aware EVM and DeFi audits
  • solana-audit — Smart contract security audits
  • axiom — Lean 4 proof verification and repair
  • skill-benchmark — Measure whether a skill actually helps
  • workers-app-tester — Mobile application security testing
  • save — Convert sessions into reusable agents
• Repository Structure
• Contributing
• License

Quick Start

Install every plugin for Claude Code in one command:

npx skills add workersio/spec

Individual plugins can be selected during installation. Once installed, invoke any skill by name inside Claude Code:

/fuzzer            Coverage-guided fuzzing with audit-driven harness design
/kage              Local pentest sandbox — recon, exploit, verify, judge, report
/kani-proof        Write bounded model checker proofs for Rust and Solana
/evm-protocol-audit  Run a structured EVM and DeFi protocol audit
/solana-audit      Run a structured smart contract security audit
/axiom             Verify and repair Lean 4 proofs
/skill-benchmark   Benchmark a skill with controlled eval sessions
/workers-app-tester   Pentest an Android app on a rooted device
/save              Save the current session as a reusable agent

Claude and Codex support are included through repo-local metadata:

• Claude marketplace catalog: .claude-plugin/marketplace.json
• Codex marketplace catalog: .agents/plugins/marketplace.json
• Per-plugin Codex manifests: plugins/<name>/.codex-plugin/plugin.json
• The Claude marketplace currently exposes 50 plugins from the repo root
• The Codex marketplace currently exposes 41 installable plugins from the repo root

To use this repo as a repo-scoped Codex marketplace:

1. Keep the repository layout intact so .agents/plugins/marketplace.json can resolve ./plugins/<name> relative to the repo root.
2. Restart Codex after cloning the repo or after changing marketplace metadata.
3. In Codex CLI, run codex, then /plugins, open the workersio marketplace, and install the plugins you want.

Root plugin ports are managed from the root repo through:

• plugins/catalog.json — root inventory for existing plugins and vendored Claude-source ports
• scripts/sync-root-plugins.mjs — regenerates marketplaces and manifests; it can still copy sourceKind: "skills" entries from skills/plugins/<name> if vendored source trees are reintroduced
• scripts/validate-root-plugins.mjs — validates manifest parity, marketplace drift, and SKILL.md relative links
• .codex-port/preserve-paths.json inside any copied plugin — opt-in list of root-only files to restore after re-sync when a plugin gets Codex-specific adaptations

Current port policy:

• plugins/<name>/ is the source of truth for installable plugin bundles; each bundle composes one or more SKILL.md files under skills/
• Codex marketplace publishes all available root plugins
• 9 high-risk Claude workflows remain staged in root plugins/ but blocked from the Codex marketplace until their hook/MCP/task-specific behavior is ported
• Currently blocked from Codex marketplace: fp-check, gh-cli, git-cleanup, modern-python, second-opinion, skill-improver, static-analysis, workflow-skill-design, zeroize-audit

Codex User-Level Install

If you want the plugins available user-wide and automatically synced to this repo, use the PowerShell installer:

pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode install

Useful commands:

pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode status
pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode uninstall
pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode install -Force

-Force backs up conflicting user-level paths to *.backup-YYYYMMDD-HHMMSS before replacing them with junctions.

To sync the repo's reusable security agents under .codex/agents together with the plugin links after future updates, run: