bex-co

@bex-co source repo

61 skills
0 followers
3 hours ago last updated

▌
Validation · bex-co bundle
Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

0
installs
▌
Fix Finding · bex-co bundle
Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

0
installs
▌
Threat Model · bex-co bundle
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

0
installs
▌
Security Scan · bex-co bundle
Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans.

0
installs
▌
Track Findings · bex-co bundle
Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use it for scans or fixes.

0
installs
▌
Triage Finding · bex-co bundle
Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.

0
installs
▌
Assess Patch Risk · bex-co bundle
Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.

0
installs
▌
Finding Discovery · bex-co bundle
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

0
installs
▌
Security Diff Scan · bex-co bundle
Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

0
installs
▌
Attack Path Analysis · bex-co bundle
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

0
installs
▌
Vulnerability Writeup · bex-co bundle
Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

0
installs
▌
Propose Security Hardening · bex-co bundle
Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.

0
installs
▌
Stripe Docs · bex-co
Use when the user or agent needs to read, search, or look up Stripe documentation or API reference. Prefer this over curl or WebFetch for any docs.stripe.com content.

0
installs
▌
Mermaid 2 · bex-co bundle
Create concise, syntax-verified Mermaid architecture diagrams. Use when the user asks to diagram a repository component, document, system, dependency flow, or supplied description in Mermaid.

0
installs
▌
Merge Upstream Main · bex-co bundle
Merge the public openai/codex-security main branch into this fork's main branch and push the result to the fork remote. Use when asked to sync or merge upstream main for this repository.

0
installs
▌
Verify Fix · bex-co bundle
Use when the user asks whether an existing security fix, patch, finding, or completed issue actually remediates the original vulnerability without modifying the repository. Do not use to validate candidate findings, implement patches, or run full repository scans.

0
installs
▌
Deep Security Scan · bex-co bundle
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

0
installs
▌
Define Security Policy · bex-co bundle
Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.

0
installs
▌
Mobile Release · bex-co bundle
Summarize mobile changes since the previous release, bump the Beancount mobile version, prepare localized release notes and listings, and release to the Apple App Store and Google Play. Use for $mobile-release or requests to cut a mobile store release. Skip ordinary code shipping, OTA-only updates, release-status questions, and requests to create or edit this skill.

0
installs
▌
QA Find Bugs Mobile · bex-co bundle
Hunt bugs in the running Beancount mobile app using local Expo MCP on the iPhone 17e simulator, sign in with QA_EMAIL and QA_PASSWORD, reproduce failures, trace root causes, and deduplicate findings. Use for native mobile QA. Skip browser-only dashboard QA, ordinary code review, and store releases.

0
installs
▌
Beancount Ask · bex-co bundle
Answer questions about a beancount ledger with BQL queries — spending, trends, net worth, burn rate, subscriptions, anomalies. Use this skill whenever the user asks an analytical/reporting question about their ledger — "how much did I spend on groceries last month", "what's my net worth", "what subscriptions am I paying for", "did anything unusual happen in May", "what's my monthly burn" — or asks for a spending report/summary. Every figure in an answer comes from a bea --json query run the user can see and re-run (bean-query only when bea is unavailable); the skill is strictly read-only. SKIP when the user wants to record transactions (beancount-options / beancount-import), reconcile against a statement (beancount-reconcile), migrate from another app (beancount-migrate), edit the ledger in any way, or asks how beancount/BQL works in general (that's a docs question, not a query over their data). The core trigger is "answer this question from my ledger's data".

0
installs
▌
Beancount Init · bex-co bundle
Scaffold a brand-new personal ledger in the current working directory. With `bea` installed, creates and validates `main.bean` through `bea init` and `bea check` — no separate Beancount install. Optional Fava browser setup (uv + Makefile) is a separate workflow when the user asks for it. Without `bea`, writes the same fourteen-account template. Trigger on /beancount-init, "set up a new beancount repo", "scaffold a beancount ledger", "start a new ledger", "bootstrap fava", or "initialize a beancount project". Do NOT trigger for questions about an existing ledger or for editing transactions.

0
installs
▌
QA Find Bugs Dashboard · bex-co bundle
Exercise the running Beancount.io dashboard with headless Playwright, use QA_EMAIL and QA_PASSWORD for login, reproduce bugs, trace fixes to source, and deduplicate findings. Use for dashboard QA or a browser bug hunt. Skip ordinary code review, bug implementation, and native-mobile QA (use qa-find-bugs-mobile).

0
installs
▌
Beancount Close · bex-co bundle
Run a month-end close ritual over a beancount ledger — reconcile every active account, verify balance assertions, check recurring-entry completeness, sweep flagged entries, and commit the month's P&L/balance-sheet summary. Use this skill whenever the user wants to close out a period — "close the month", "run my June close", "do my month-end", "wrap up May's books". The skill walks a fixed checklist, delegates account-level reconciliation to beancount-reconcile, surfaces everything unverifiable, and only commits after the user confirms the close report. SKIP when the user wants to reconcile a single account (beancount-reconcile directly), import an export (beancount-import), ask an ad-hoc question (beancount-ask), or record individual transactions. The core trigger is "close the books for this period".

0
installs
▌
Beancount Import · bex-co bundle
Import a bank or card export (CSV, OFX, QIF) into a beancount ledger as categorized, deduplicated transactions. Use this skill whenever the user has an export file from a bank, credit card, or brokerage cash account and wants those transactions recorded — "import this CSV", "record my May bank export", "add these transactions to my ledger", or when they point to a downloaded export file and ask to book it. The skill stages every row, suggests a category for each from the ledger's own history, skips rows already imported (via import-id metadata), and appends only after the user confirms a review table, then verifies with bea check (or bean-check only when bea is absent). SKIP when the user wants to check the ledger against a statement and fix discrepancies (beancount-reconcile), migrate full history from Mint/Monarch/QuickBooks (beancount-migrate), build a reusable Python importer for a source (beancount-importer-author), or record a single described trade (beancount-options). The core trigger is "here is an e

0
installs
▌
Routine Flaky Test Fixer · bex-co
Autonomous maintenance routine that root-causes intermittently failing CI tests — mining GitHub Actions history for same-commit red-to-green reruns, reproducing locally with repeated runs, fixing the real nondeterminism (timers, teardown, ordering, unawaited promises), and shipping via /ship after 20 consecutive green runs. Use only when the user explicitly invokes /routine-flaky-test-fixer or asks to hunt down flaky tests. SKIP for tests that can never fail (routine-useless-test-pruner) and for logic bugs that fail deterministically (routine-logic-bugfixer). The core trigger is "this test sometimes fails; make it deterministic".

0
installs
▌
Beancount Migrate · bex-co bundle
Migrate transaction history from a personal-finance app export (Mint, Monarch, QuickBooks Online, Copilot, Bench handoff, or any category-tagged CSV export) into a new beancount ledger. Use this skill whenever the user has a full-history export from a finance app and wants out — "migrate me from Mint", "Monarch export to beancount", "my bookkeeping service shut down, here's the CSV", "convert my QuickBooks history to plain text". The skill proposes an account hierarchy from the export's categories, converts all history with transfer deduplication and opening balances, verifies counts and balances against the source, and optionally starts Fava when requested. SKIP when the user wants to import an ongoing bank export into an existing ledger (beancount-import), reconcile against a statement (beancount-reconcile), start fresh with no history (beancount-init alone), or record individual transactions. The core trigger is "here is my old app's full export — turn it into a beancount ledger".

0
installs
▌
Beancount Options · bex-co bundle
Convert natural-language descriptions of specific options trades into beancount transactions and append them to the user's ledger. Use this skill whenever the user describes an options event that happened (sold/bought a call or put, opened/closed/rolled a position, got assigned/exercised, an option expired) and wants it recorded in beancount. Triggers on multi-leg strategies (verticals, condors, butterflies, straddles, calendars, diagonals, collars, the wheel), single-leg trades (cash-secured puts, covered calls, naked options, long calls/puts), and any options trade described in plain English or pasted from a broker confirmation. Also triggers on jargon like STO/BTC/STC/BTO, "I rolled", "got assigned", "expired worthless". SKIP when the user is asking for explanations of how options work, calculations like greeks/IV/breakevens, tax planning advice, P&L reports or summaries, broker statement CSV imports, or live analytics/dashboards — those are different workflows. The core trigger is "record this specific tr

0
installs
▌
Routine Dead Code Removal · bex-co
Autonomous maintenance routine that deletes provably unreachable code from one monorepo package using the repo's own detectors (yarn lint:deadcode / make deadcode / scripts/lint-deadcode.sh), verifies every hit against dynamic references before deleting, and ships each removal via /ship. Use only when the user explicitly invokes /routine-dead-code-removal or asks to find and delete dead or unused code. SKIP for dead branches behind a feature flag (routine-shipped-feature-inliner), live duplicates whose callers need repointing (routine-dup-unifier), tests that pass but assert nothing (routine-useless-test-pruner), or live single-implementation indirection (routine-abstraction-improver). The core trigger is "find and delete code nothing can reach".

0
installs
▌
Beancount Reconcile · bex-co bundle
Reconcile one beancount account against a bank or broker statement. Use this skill whenever the user wants to check that their ledger matches a statement — "reconcile my checking account", "does my ledger match my May Chase statement", "find the missing transactions for last month", "why is my balance off", or when they paste/point to a statement (CSV export or PDF text) and ask to compare it to the ledger. The skill reports a diff (missing, duplicate, amount-mismatch, date-drift) and, only after explicit confirmation, appends the missing transactions plus a period-end balance assertion, then verifies with bea check (bean-check only when bea is absent). SKIP when the user wants to bulk-import a statement as the primary source of new transactions (that is an import workflow, not reconciliation), record a single specific trade or transaction, ask analytics/reporting questions ("top expenses"), or edit existing entries. The core trigger is "check my ledger against this statement and fix what's missing".

0
installs
▌
Routine Useless Test Pruner · bex-co
Autonomous maintenance routine that finds tests that cannot fail — no real assertions, tautologies that assert a mock returns what it was told, mock-everything tests that never touch the unit — proves it mechanically by breaking the covered behavior and watching the test stay green, deletes them, and ships via /ship. Use only when the user explicitly invokes /routine-useless-test-pruner or asks to prune useless/worthless tests. SKIP for tests that fail intermittently (routine-flaky-test-fixer), tests of code being deleted (they travel with their code), and slow-but-valid tests. The core trigger is "delete tests that can't fail".

0
installs
▌
Routine Abstraction Improver · bex-co
Autonomous maintenance routine that flattens over-engineered abstractions in a monorepo package — interfaces with one implementation and no stated reason, passthrough wrappers, one-product factories, delegate-only manager layers — by inlining the single thing behind them and shipping via /ship. Use only when the user explicitly invokes /routine-abstraction-improver or asks to flatten needless indirection. SKIP for convoluted logic inside one unit (routine-logic-simplifier), imports crossing stated boundaries (routine-abstraction-police), and duplicated implementations (routine-dup-unifier). The core trigger is "remove indirection that has exactly one thing behind it".

0
installs
▌
Routine Shipped Feature Inliner · bex-co
Autonomous maintenance routine that finds gates for fully shipped features — flags, env switches, boolean guards that have held one value everywhere for a long time — triages deliberate gates from forgotten ones, inlines the enabled path, deletes the dead branch and the flag itself, and ships each removal via /ship. Use only when the user explicitly invokes /routine-shipped-feature-inliner or asks to clean up shipped/stale feature flags. SKIP for unreachable code not behind a flag (routine-dead-code-removal) and for changing what any flag is set to — this routine never flips a value. The core trigger is "this feature fully shipped; remove its flag and inline the winning path".

0
installs
▌
Beancount Importer Author · bex-co bundle
Write or repair a beangulp importer (the beancount v3 import framework) for a bank/card export format, tested against a sample file until its own harness passes. Use this skill whenever the user wants a reusable Python importer — "write an importer for my Chase CSV", "make this source a real importer", "my importer broke, the bank changed the format", "codify this import so I don't need the agent every week" — or when beancount-import suggests graduating a repeatedly-imported source. The skill drafts the importer (csvbase for CSVs, raw beangulp.Importer otherwise), generates golden files, and iterates until `test` is green; wiring into the user's import script is confirm-gated. SKIP when the user just wants this one file's transactions in the ledger (beancount-import), wants to reconcile (beancount-reconcile), or is migrating full app history (beancount-migrate). The core trigger is "make/fix the reusable importer for this source".

0
installs
▌
Pm · bex-co bundle
Inspect and maintain the repository's .pm workstreams, inbox notes, milestones, and tasks. Use when the user asks for PM board status or requests a supported board mutation such as creating, promoting, adding, or completing work.

0
installs
▌
Ship · bex-co bundle
Safely bring main up to date, commit intended pending changes, and push to origin/main — resolving any rebase conflicts autonomously and stopping only when a decision genuinely needs a human. Use when the user explicitly asks to ship the current main branch or invokes the repository's ship workflow.

0
installs
▌
Mermaid · bex-co bundle
Create concise, syntax-verified Mermaid architecture diagrams. Use when the user asks to diagram a repository component, document, system, dependency flow, or supplied description in Mermaid.

0
installs
▌
Release · bex-co bundle
Autonomously release a bex component (today cli) — sync shipped main, choose the version, publish the tag, recover routine failures, and verify every distribution channel. Use when the user asks to release, publish, or bump the CLI. /ship lands code; /release mints versions.

0
installs
▌
Simplify · bex-co bundle
Review the changed code for reuse, simplification, efficiency, and altitude cleanups, then apply the fixes. Quality only — it does not hunt for bugs; use /code-review for that.

0
installs
▌
Deploy App · bex-co bundle
Deploy a bex App to the current Kubernetes cluster and verify it reaches Ready. Use when the user asks to deploy a render.yaml (or legacy bex.yml) or the sample app and validate the rollout end to end. Optional argument: path to render.yaml.

0
installs
▌
Loop Worker · bex-co bundle
Autonomously work a `.pm` workstream to completion — pick the next pending milestone, implement every task end to end, /ship it, then move to the next until none remain. Use when the user asks to "loop", drain, or work through a whole workstream's backlog (e.g. `/loop-worker w1`). Sequential, not interval-based; for a timed poll use /loop.

0
installs
▌
Mock Cluster · bex-co bundle
Stand up or scale the local CAPD mock cluster and deploy the bex operator into it. Use when the user asks to create, inspect, or resize the repository's local development cluster. Optional argument: scale N.

0
installs
▌
QA Find Bugs · bex-co
Drive the live product at https://dashboard.bex.co as a signed-in QA user (QA_EMAIL / QA_PASSWORD from .env), hunt real bugs across the hosting features, research each fix down to file:line, file the non-duplicate findings to the w6 board through /pm, and /ship the scheduled milestone. Use when the user asks to QA the dashboard, try the product and find bugs, or run a live hosting bug hunt.

0
installs
▌
Pm Brainstorm · bex-co bundle
Analyze and decompose a product topic into a text-only proposal for the repository's .pm board. Use when the user wants to pressure-test scope, size milestones, identify dependencies, or prepare exact PM board commands without writing board files.

0
installs
▌
Security Audit · bex-co bundle
Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

0
installs
▌
Upgrade Stripe · bex-co
Guide for upgrading Stripe API versions and SDKs

0
installs
▌
Stripe Projects · bex-co
Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.

0
installs
▌
QA Find Bugs CLI · bex-co
Hunt live hosting bugs through the bex CLI against the pinned Render CLI contract, trace failures into server compatibility or the Bex launcher, and file researched, non-duplicate fixes through /pm. Use when asked to QA the CLI or find hosting bugs from terminal journeys. Ships the filing only when explicitly authorized.

0
installs
▌
Stripe Directory · bex-co
Use when the user wants to find businesses, software, service providers, or partners for a specific industry, workflow, pain point, capability, or job to be done. Also use when the agent needs to programmatically purchase or consume a service. Use Stripe Directory to build a short relevant shortlist, even if the user does not mention Stripe Directory explicitly.

0
installs
▌
Routine Dead Code · bex-co bundle
Deletes provably unreachable code using the repo's wired-in analyzers — whole-program deadcode for Go and knip for the dashboard — plus manual cross-language reachability checks before every deletion. Use when the user asks to run the dead-code routine or sweep for unreachable code.

0
installs
▌
Routine Dup Unifier · bex-co bundle
Finds duplicated implementations across modules and merges each into one canonical helper, respecting the workspace import DAG (operator→types←backend; cli imports no sibling); inherent two-sided duplication gets a drift-guard test instead. Use when the user asks to run the dup-unifier routine, deduplicate code, or unify parallel helpers.

0
installs
▌
Routine Flaky Tests · bex-co bundle
Root-causes flaky CI tests by mining GitHub Actions run history for same-SHA flips, reproducing locally under race and stress, and fixing the actual race or timing bug — never by adding retries, sleeps, or skips. Use when the user asks to run the flaky-tests routine or investigate intermittent CI failures.

0
installs
▌
Routine Crash Fuzzer · bex-co bundle
Hunts real application crashes — first by listening to bex platform service logs for panics, crash loops, and 5xx bursts, then by fuzzing untrusted-input parsers with Go native fuzzing — and lands root-cause fixes with regression tests. Use when the user asks to run the crash-fuzzer routine, hunt panics or crashes, fuzz the platform, or investigate service crashes.

0
installs
▌
Routine Flag Inliner · bex-co bundle
Removes gates for fully-shipped features — stale growthbook-shaped dashboard flags and always-on backend config booleans — by inlining the enabled branch and deleting flag machinery when the last flag goes; subset/beta-targeted flags are out of scope and skipped with a note. Use when the user asks to run the flag-inliner routine, clean up feature flags, or inline shipped gates.

0
installs
▌
Deploy App From Local · bex-co bundle
Deploy a local checkout to a production Hetzner App using the manual image-import runbook. Use when the user asks to ship local working-tree code to a live bex App rather than deploy from remote Git. Arguments are the local repo path and app name.

0
installs
▌
Routine Useless Tests · bex-co bundle
Finds tests that cannot fail — assert-nothing, tautological, mock-echoing, or trivially-true polling — and deletes them or strengthens them into real behavioral tests, using mutation spot-checks as proof. Use when the user asks to run the useless-tests routine, prune worthless tests, or audit test quality.

0
installs
▌
Stripe Best Practices · bex-co bundle
Guides Stripe integration decisions across API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, restricted keys, webhooks, OAuth). Use when building, modifying, or reviewing any Stripe integration, including accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling.

0
installs
▌
Routine Logic Bugfixer · bex-co bundle
Picks a tricky logic domain — billing and pricing math, OpenFGA authz scope decisions, blueprint plan diffs — models it explicitly with invariants, truth tables, and property tests, and fixes the real bugs the model surfaces with regression tests. Use when the user asks to run the logic-bugfixer routine, hunt for logic bugs, or property-test a subsystem.

0
installs
▌
Routine Logic Simplifier · bex-co bundle
Sweeps existing code for convoluted business logic — deep nesting, boolean spaghetti, multi-responsibility functions — and simplifies it behavior-preservingly with test coverage as the safety net. Use when the user asks to run the logic-simplifier routine or untangle convoluted logic across the codebase; for reviewing just-changed code use /simplify instead.

0
installs
▌
Routine Abstraction Police · bex-co bundle
Audits and fixes layering violations against the workspace import DAG (operator→types←backend; cli standalone; dashboard consumes the API, never reimplements it) and adds depguard rules so violations can't return. Use when the user asks to run the abstraction-police routine, audit module boundaries, or fix layering violations.

0
installs
▌
Routine Abstraction Flattener · bex-co bundle
Finds over-engineered abstractions — single-implementation interfaces, pass-through layers, generics instantiated at one type, wrapper hooks that add nothing — and flattens them to direct code; module-boundary seams are left to routine-abstraction-police. Use when the user asks to run the abstraction-flattener routine, remove over-engineering, or flatten needless indirection.

0
installs

61 published skills