Skill instructions
codex-security-cloud8.74 KB
View saved version →
---
name: codex-security-cloud
description: Use Daybreak Defense Factory (also called Daybreak or Codex Security Cloud) from chat to launch, inspect, or cancel scans and read findings, or open its UI for setup and continuous monitoring.
---
# Daybreak Defense Factory
“Daybreak”, “Daybreak Defense Factory”, and “Codex Security Cloud” refer to this same plugin. Use the existing `defense_factory_*` tools for all three names.
Use the connected Daybreak tools directly for chat requests such as "Scan owner/repo", "How is my scan doing?", "Summarize its findings", or "Cancel that scan". Discover the relevant `defense_factory_*` tools through tool search when needed. A clear request to launch or cancel authorizes that action; do not ask for a duplicate confirmation.
## Check setup before using data tools
Before listing or reading scans, findings, repositories, environments, or usage, or launching a scan, call `defense_factory_bootstrap` for the current workspace. Reuse its result within the current request; check again after the workspace changes or the user completes connection setup.
- If access is denied or workflows are disabled, explain the returned setup requirement and use the active app for setup, opening it if needed. Do not continue with data tools.
- If `githubConnected` is false or `githubConnectorIds` is an empty list, explain that GitHub must be connected in this workspace and use the active app for setup, calling `open_defense_factory` only if it is not already active. Stop data calls until the user has connected GitHub, then check bootstrap again.
- Null connection state means discovery was unavailable, not that GitHub is disconnected. Existing reads may still be authorized; do not treat this as a confirmed missing connection.
- If a data tool returns `no_github_connection`, stop further data calls and use the same connection setup flow. Do not retry it as a service outage or report that there are no scans or findings.
## Launch a scan
1. Use `githubConnectorIds` from the setup check. Pass the appropriate returned ID as `connector_id` to `defense_factory_github_search` or `defense_factory_github_repositories`; search the active connections when the target's connector is unknown. Use `defense_factory_github_get` for an already known repository ID. Preserve returned repository IDs and connector identity, including GitHub Enterprise namespaces.
2. Use `defense_factory_environments_list` or `defense_factory_environments_search` to find an existing environment containing that repository on the same connector. Use the user's selection or an unambiguous match; ask when multiple compatible choices remain. If none exists, use the setup fallback below.
3. Read `defense_factory_workflow_definition` for workflow ID `codex-security.security-scan`. Build launch `steps` using its returned step IDs and model/reasoning options. Use the user's supported selections or a sole returned option; ask for unresolved choices instead of inventing defaults. Omit `reasoning` when the step does not offer it. Use `defense_factory_usage_get` when scan availability or credits matter; backend launch checks still decide admission.
4. Call `defense_factory_workflow_launch` with those selections and one idempotency key for this launch attempt. Preserve the same key and inputs when retrying an ambiguous response; changing the key could start another paid scan. Report a conflict or unresolved failure instead of creating a replacement launch.
5. Return the run ID, repository, target revision, and reported status. `queued` confirms acceptance and `running` means work is in progress. Report successful completion only for `completed`. Report `failed` with the returned failure details, and report `canceled` as cancellation, not success.
## Inspect results or cancel
Use `defense_factory_workflow_list` and `defense_factory_workflow_repositories` to find runs, and `defense_factory_workflow_get` for the exact run's status and output IDs. Read output metada
Preview of the first 4,000 characters. Read full instructions →
Referenced files: 1 — file references are metadata, not package contents.
local-deep-security-scan978 Bytes
View saved version →
---
name: local-deep-security-scan
description: Continue a Daybreak desktop local scan when the host assigns this skill to a native deep scan thread.
---
# Daybreak local deep scan
Load the scan context with the `daybreak-local` server's
`get_codex_security_scan_context` tool. Use the scan ID and handoff claim token
in the host's first message. Keep the scan's checkout, scope, mode, and context.
Read the `daybreakWorkflow.skillPath` returned in the tool's structured
response and follow that workflow as a native continuation. Resolve supporting
files relative to that skill file. If the workflow names a supporting security
skill, read `skills/<unqualified-name>/SKILL.md` under the returned
`daybreakWorkflow.bundleRoot` and use that path when passing the skill to a
worker. Keep tool calls on the `daybreak-local`
server. If the workflow path is missing or the context mode is incompatible,
report that the installed Daybreak runtime could not load the scan workflow.
Referenced files: 1 — file references are metadata, not package contents.
local-security-diff-scan978 Bytes
View saved version →
---
name: local-security-diff-scan
description: Continue a Daybreak desktop local scan when the host assigns this skill to a native diff scan thread.
---
# Daybreak local diff scan
Load the scan context with the `daybreak-local` server's
`get_codex_security_scan_context` tool. Use the scan ID and handoff claim token
in the host's first message. Keep the scan's checkout, scope, mode, and context.
Read the `daybreakWorkflow.skillPath` returned in the tool's structured
response and follow that workflow as a native continuation. Resolve supporting
files relative to that skill file. If the workflow names a supporting security
skill, read `skills/<unqualified-name>/SKILL.md` under the returned
`daybreakWorkflow.bundleRoot` and use that path when passing the skill to a
worker. Keep tool calls on the `daybreak-local`
server. If the workflow path is missing or the context mode is incompatible,
report that the installed Daybreak runtime could not load the scan workflow.
Referenced files: 1 — file references are metadata, not package contents.
local-security-scan981 Bytes
View saved version →
---
name: local-security-scan
description: Continue a Daybreak desktop local scan when the host assigns this skill to a native standard scan thread.
---
# Daybreak local standard scan
Load the scan context with the `daybreak-local` server's
`get_codex_security_scan_context` tool. Use the scan ID and handoff claim token
in the host's first message. Keep the scan's checkout, scope, mode, and context.
Read the `daybreakWorkflow.skillPath` returned in the tool's structured
response and follow that workflow as a native continuation. Resolve supporting
files relative to that skill file. If the workflow names a supporting security
skill, read `skills/<unqualified-name>/SKILL.md` under the returned
`daybreakWorkflow.bundleRoot` and use that path when passing the skill to a
worker. Keep tool calls on the `daybreak-local`
server. If the workflow path is missing or the context mode is incompatible,
report that the installed Daybreak runtime could not load the scan workflow.
Referenced files: 1 — file references are metadata, not package contents.
open-defense-factory766 Bytes
View saved version →
---
name: open-defense-factory
description: Open Codex Security Cloud for cloud security findings, scans, and continuous repository monitoring.
---
# Codex Security Cloud
Use the connected Codex Security Cloud app's `open_defense_factory` tool to open its interactive UI. If the tool is not loaded, discover it through the available tool search.
The UI uses the current ChatGPT workspace and its existing Cloud and security permissions. Let its setup controls handle GitHub connections and Cloud environments. Do not request credentials or change workspace permissions to make a request succeed.
Use the UI for repository selection, scan setup, and finding triage. Opening the app does not authorize starting scans, changing findings, or creating pull requests.
