Calif.io Skills

A Claude Code plugin marketplace from Calif.io providing skills and slash commands for AI-assisted security research and code auditing.

Installation

Add the marketplace once:

/plugin marketplace add califio/skills

Then browse and install plugins:

/plugin menu

Codex

A Codex-native skill tree lives at .codex/skills/ (symlinked to the same content used by the Claude plugins). Install with:

git clone https://github.com/califio/skills.git ~/.codex/califio-skills
~/.codex/califio-skills/.codex/scripts/install-for-codex.sh

See .codex/INSTALL.md for details.

Local development

To test changes locally, from the parent directory of this repo:

/plugin marketplace add ./skills

Available plugins

Code auditing

Contributing

New plugins are welcome. The repo follows the standard Claude Code plugin marketplace layout:

.claude-plugin/marketplace.json          # marketplace index — add an entry here
plugins/<plugin-name>/
  .claude-plugin/plugin.json             # plugin metadata
  skills/<skill-name>/SKILL.md           # the skill (Claude auto-loads by description)
  commands/<command-name>.md             # slash command (optional)
  agents/<agent-name>.md                 # subagents (optional)

A plugin can ship any combination of skills, commands, agents, and MCP servers. To add one:

1. Create plugins/<your-plugin>/ with the structure above.
2. Add an entry to .claude-plugin/marketplace.json.
3. Open a PR.

License

MIT © Calif.io

{
  "name": "califio",
  "owner": {
    "name": "Calif.io",
    "email": "help@calif.io",
    "url": "https://github.com/califio/skills"
  },
  "metadata": {
    "version": "0.1.0",
    "description": "Claude Code plugins from Calif.io for AI-assisted security research and code auditing"
  },
  "plugins": [
    {
      "name": "php-unserialize-audit",
      "version": "0.1.0",
      "description": "Audit PHP engine deserialization surface (unserialize, session decoders, WDDX, phar metadata, custom ce->unserialize handlers) for UAF, type confusion, partial-object __destruct, signed-length heap overflow, and parse inconsistency.",
      "author": {
        "name": "Calif.io",
        "email": "help@calif.io",
        "url": "https://github.com/califio/skills"
      },
      "source": "./plugins/php-unserialize-audit"
    }
  ]
}