Codex Security Scan
Use the official Codex Security plugin for the scan. Do not substitute an ad hoc
model review, dependency audit, or unrelated scanner when the plugin is absent.
Preflight
- Confirm that the current session exposes the Codex Security plugin or its
contributed scan capability.
- If it is missing, stop before reading repository scan configuration. Tell the
user to open
/plugins in Codex CLI, install Codex Security, and start a
new session. Do not install software or switch to API-key billing unless the
user explicitly asks.
- If the plugin is installed but reports an authentication, access, or usage
problem, report that exact condition separately from a scan failure. For
subscription-backed use, direct the user to authenticate Codex with their
ChatGPT account; do not silently fall back to an API key.
- Scan only a repository the user owns or is authorized to assess.
Repository configuration
Resolve the repository root, then look for
docs/security/codex-security.md. Read it completely only when this skill is
invoked and the plugin preflight passes.
- Apply its scope, exclusions, threat model, mode, artifact handling, and
reporting requirements unless the user explicitly overrides them.
- If it is absent, use a standard, whole-repository, read-only scan and disclose
that no repository-specific Codex Security configuration was found.
- Treat configuration as scan guidance, not authorization to modify code,
publish findings, create issues, or open pull requests.
Run the scan
- Default to a standard, report-only scan. Use deep, diff, or working-tree mode
only when the user or repository configuration requests it.
- Confirm and report the target revision and scope. For a scheduled scan, follow
the configured scheduled target rather than assuming the current worktree is
correct.
- Keep detailed artifacts in the plugin's private state or another location
outside the repository. Never commit vulnerability reports or source excerpts.
- Do not patch findings, create commits, open pull requests, or publish tracking
items without separate explicit authorization.
- Let the plugin finish and use its findings and coverage artifacts as the
source of truth. Partial or unknown coverage is incomplete, not a passing scan.
Report
Return the scan status, repository and revision, mode and scope, critical/high
findings first, artifact location, and coverage status. Include exclusions,
deferred surfaces, and open questions. When blocked, distinguish among missing
plugin, authentication/access, usage limit, invalid target, scanner failure, and
incomplete coverage, and give the next concrete action.
1---2name: codex-security-scan3description: Run or diagnose an authorized repository scan with the official Codex Security plugin, applying repository-specific scope and reporting policy when present. Use for explicit security scans, scheduled scan runs, or Codex Security preflight failures; not for ordinary code review.4---56# Codex Security Scan78Use the official Codex Security plugin for the scan. Do not substitute an ad hoc9model review, dependency audit, or unrelated scanner when the plugin is absent.1011## Preflight12131. Confirm that the current session exposes the Codex Security plugin or its14 contributed scan capability.152. If it is missing, stop before reading repository scan configuration. Tell the16 user to open `/plugins` in Codex CLI, install **Codex Security**, and start a17 new session. Do not install software or switch to API-key billing unless the18 user explicitly asks.193. If the plugin is installed but reports an authentication, access, or usage20 problem, report that exact condition separately from a scan failure. For21 subscription-backed use, direct the user to authenticate Codex with their22 ChatGPT account; do not silently fall back to an API key.234. Scan only a repository the user owns or is authorized to assess.2425## Repository configuration2627Resolve the repository root, then look for28`docs/security/codex-security.md`. Read it completely only when this skill is29invoked and the plugin preflight passes.3031- Apply its scope, exclusions, threat model, mode, artifact handling, and32 reporting requirements unless the user explicitly overrides them.33- If it is absent, use a standard, whole-repository, read-only scan and disclose34 that no repository-specific Codex Security configuration was found.35- Treat configuration as scan guidance, not authorization to modify code,36 publish findings, create issues, or open pull requests.3738## Run the scan3940- Default to a standard, report-only scan. Use deep, diff, or working-tree mode41 only when the user or repository configuration requests it.42- Confirm and report the target revision and scope. For a scheduled scan, follow43 the configured scheduled target rather than assuming the current worktree is44 correct.45- Keep detailed artifacts in the plugin's private state or another location46 outside the repository. Never commit vulnerability reports or source excerpts.47- Do not patch findings, create commits, open pull requests, or publish tracking48 items without separate explicit authorization.49- Let the plugin finish and use its findings and coverage artifacts as the50 source of truth. Partial or unknown coverage is incomplete, not a passing scan.5152## Report5354Return the scan status, repository and revision, mode and scope, critical/high55findings first, artifact location, and coverage status. Include exclusions,56deferred surfaces, and open questions. When blocked, distinguish among missing57plugin, authentication/access, usage limit, invalid target, scanner failure, and58incomplete coverage, and give the next concrete action.
dcouple