{"id":239,"external_id":"Plugin_1e648473be9c8191a91ac3947151af55","name":"codex-security","display_name":"Codex Security","developer":"OpenAI","category":"Security","listing_language":"en","listing_language_details":{"method":"cld-0.13.0/listing-v1","reliable":true,"detected_at":"2026-10-01T13:21:51Z","input_sha256":"ff8a8995d4b02248d93749c3a1bbbd05e0f334859992252b27cf8688aaf8d22f","source_fields":["release.description","release.interface.short_description","release.interface.long_description"]},"version":"0.1.31","skill_count":15,"first_seen_at":"2026-09-30T22:02:35.000Z","last_seen_at":"2026-10-02T06:00:01.935Z","last_changed_at":"2026-09-30T23:19:58.694Z","install_count":null,"research_summary":null,"research_reviewed_at":null,"metadata":{"id":"Plugin_1e648473be9c8191a91ac3947151af55","name":"codex-security","scope":"GLOBAL","status":"ENABLED","release":{"id":"pluginrel_6ab6b60d3b288191b945643ce5b4070c","skills":[{"name":"assess-patch-risk","interface":{"brand_color":null,"iconography":null,"display_name":"Assess Patch Risk","default_prompt":"Use $assess-patch-risk to trace this exact patch's program impact, regression protection, counterexamples, recoverability, and merge recommendation.","icon_large_url":null,"icon_small_url":null,"short_description":"Assess patch impact and merge risk"},"description":"Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.","plugin_release_skill_id":"pluginrsk_6ab6b60e77d081919b5ef3e16c062cb2"},{"name":"attack-path-analysis","interface":{"brand_color":null,"iconography":null,"display_name":"Attack Path Analysis","default_prompt":"Use $attack-path-analysis to trace a given security finding from source to sink and calibrate severity accordingly.","icon_large_url":null,"icon_small_url":null,"short_description":"Perform attack-path analysis for a security finding"},"description":"Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e77d88191bc2a8ff9936d931f"},{"name":"deep-security-scan","interface":{"brand_color":null,"iconography":null,"display_name":"Deep Security Scan","default_prompt":"Use $codex-security:deep-security-scan to run a deep Codex Security scan.","icon_large_url":null,"icon_small_url":null,"short_description":"Run a deeper security scan"},"description":"Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.","plugin_release_skill_id":"pluginrsk_6ab6b60e77dc819190dcf7addbb89e3d"},{"name":"define-security-policy","interface":{"brand_color":null,"iconography":null,"display_name":"Define Security Policy","default_prompt":"Define or update this repository's SECURITY.md and show the proposed diff.","icon_large_url":null,"icon_small_url":null,"short_description":"Define scoped SECURITY.md scan guidance"},"description":"Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.","plugin_release_skill_id":"pluginrsk_6ab6b60e77e4819185c6cb897bc5e1ae"},{"name":"finding-discovery","interface":{"brand_color":null,"iconography":null,"display_name":"Finding Discovery","default_prompt":"Use $finding-discovery to discover security findings in the current repository or a given code change.","icon_large_url":null,"icon_small_url":null,"short_description":"Discover security findings"},"description":"Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e77e8819196717fabff323894"},{"name":"fix-finding","interface":{"brand_color":null,"iconography":null,"display_name":"Fix Security Finding","default_prompt":"Use $fix-finding to fix a given security finding and verify the issue no longer reproduces.","icon_large_url":null,"icon_small_url":null,"short_description":"Fix and verify a given security finding"},"description":"Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e77f0819196c2e43664c8a4a0"},{"name":"propose-security-hardening","interface":{"brand_color":null,"iconography":null,"display_name":"Propose Security Hardening","default_prompt":"Use $propose-security-hardening to develop and compare structural security hardening options from these disclosures, findings, or scan results.","icon_large_url":null,"icon_small_url":null,"short_description":"Design evidence-backed security hardening options"},"description":"Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.","plugin_release_skill_id":"pluginrsk_6ab6b60e77f481919aa34e68f556e424"},{"name":"security-diff-scan","interface":{"brand_color":null,"iconography":null,"display_name":"Security Diff Scan","default_prompt":"Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch. Cover all in-scope changed files and complete the required scan phases.","icon_large_url":null,"icon_small_url":null,"short_description":"Run security review on a Git diff"},"description":"Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.","plugin_release_skill_id":"pluginrsk_6ab6b60e77f88191a633da16185e813b"},{"name":"security-scan","interface":{"brand_color":null,"iconography":null,"display_name":"Security Scan","default_prompt":"Run a Codex Security scan on this repository or scoped path using subagents. Cover all in-scope files and complete the required scan phases.","icon_large_url":null,"icon_small_url":null,"short_description":"Run repository or scoped-path security scan"},"description":"Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e77fc81918386ba570ed3230d"},{"name":"threat-model","interface":{"brand_color":null,"iconography":null,"display_name":"Threat Model","default_prompt":"Use $threat-model to build a repository threat model.","icon_large_url":null,"icon_small_url":null,"short_description":"Build a repository threat model"},"description":"Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e78008191a31bdba36ec4f6f5"},{"name":"track-findings","interface":{"brand_color":null,"iconography":null,"display_name":"Track Findings","default_prompt":"Track validated Codex Security findings. Show a reviewable dry run before writing.","icon_large_url":null,"icon_small_url":null,"short_description":"Track findings in Linear, Jira, GitHub issues, or draft advisories"},"description":"Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use it for scans or fixes.","plugin_release_skill_id":"pluginrsk_6ab6b60e78048191b8c92f2509f66851"},{"name":"triage-finding","interface":{"brand_color":null,"iconography":null,"display_name":"Triage Finding","default_prompt":"Use $triage-finding to triage supplied or imported security findings against <repo/path>. For Jira, use Atlassian Rovo only as an intake connector to import Jira issues matching <JQL or project/search>; for Linear, use Linear only as an intake connector for supplied issue URLs/IDs or search results. Return one static-evidence verdict per finding: confirmed, not_actionable, or needs_review. Finding(s) or source: <paste SARIF, CVE/GHSA/advisory text, scanner ticket, Jira/Linear security or vulnerability tickets, bug bounty report, Codex Security artifact, or GitHub finding source here>.","icon_large_url":null,"icon_small_url":null,"short_description":"Import security or vulnerability tickets from Jira/Linear, scanners, advisories, or GitHub"},"description":"Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.","plugin_release_skill_id":"pluginrsk_6ab6b60e78088191a2f0ddd3b79a89d6"},{"name":"validation","interface":{"brand_color":null,"iconography":null,"display_name":"Validation","default_prompt":"Use $validation to determine whether a given security finding is valid.","icon_large_url":null,"icon_small_url":null,"short_description":"Validate a security finding"},"description":"Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e780c8191808b0534edd59550"},{"name":"verify-fix","interface":{"brand_color":null,"iconography":null,"display_name":"Verify Fix","default_prompt":"Use $verify-fix to verify that a reported security vulnerability is fixed without modifying the repository.","icon_large_url":null,"icon_small_url":null,"short_description":"Verify security fixes without changing code"},"description":"Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.","plugin_release_skill_id":"pluginrsk_6ab6b60e78108191b58c20f27fe5b941"},{"name":"vulnerability-writeup","interface":{"brand_color":null,"iconography":null,"display_name":"Vulnerability Writeup","default_prompt":"Use $vulnerability-writeup to turn a corpus of vulnerability notes into polished, source-backed disclosure reports.","icon_large_url":null,"icon_small_url":null,"short_description":"Write up a vulnerability into a polished, self-contained, source-backed report."},"description":"Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.","plugin_release_skill_id":"pluginrsk_6ab6b60e78148191b3da17034dde6e5d"}],"app_ids":["asdk_app_69a089a326dc8191b32a3f2553f5be2c","connector_76869538009648d5b282a4bb21c3d157","connector_692de805e3ec8191834719067174a384"],"version":"0.1.31","keywords":["security","code-review","diff-review","appsec","threat-modeling"],"interface":{"category":"Security","logo_url":"https://files.openai.com/content?id=file_00000000e6e081f58c772f187325eb6a","brand_color":"#111111","website_url":"https://openai.com/","capabilities":["Interactive","Read","Write"],"logo_url_dark":null,"default_prompt":"Run a Codex Security scan on this repository.","developer_name":"OpenAI","default_prompts":["Run a Codex Security scan on this repository.","Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch.","Triage existing security findings against this repository."],"screenshot_urls":[],"long_description":"Codex Security packages reusable workflows for security scans, analysis, validation, and investigation across code, diffs, and related artifacts.","composer_icon_url":"https://files.openai.com/content?id=file_00000000f73c81f583df4c30fb524aa6","short_description":"Security scanning for your codebase","plugin_category_id":"security","privacy_policy_url":"https://openai.com/policies/row-privacy-policy/","terms_of_service_url":"https://openai.com/policies/row-terms-of-use/","composer_icon_dark_url":null},"description":"Codex Security workflows for security scans, analysis, and investigation.","app_manifest":{"apps":{"github":{"id":"connector_76869538009648d5b282a4bb21c3d157","category":"Code Hosting & Security Findings"},"linear":{"id":"asdk_app_69a089a326dc8191b32a3f2553f5be2c","category":"Work Tracking & Coordination"},"atlassian":{"id":"connector_692de805e3ec8191834719067174a384","category":"Work Tracking & Coordination","capabilities":["read","write"]}}},"display_name":"Codex Security","app_templates":[],"onboarding_skill_name":null,"requires_local_executor":true},"created_at":"2026-05-14T00:26:39.198654Z","is_template":false,"connector_id":null,"discoverability":"LISTED","canonical_app_id":null},"research":null,"package_metadata":{"name":"codex-security","author":{"name":"OpenAI"},"license":"Proprietary","sources":[{"path":".codex-plugin/plugin.json","sha256":"3ddcc187fe2f1aff961bf55444e70bfbc3f825b6185ab3f29860d1a813a395f9"}],"version":"0.1.31","homepage":"https://developers.openai.com/codex/security","keywords":["security","code-review","diff-review","appsec","threat-modeling"],"repository":"https://github.com/openai/openai/tree/master/chatgpt/oai-maintained-plugins/plugins/codex-security","artifact_id":6708,"observed_at":"2026-10-02T00:04:04Z","capabilities":["Interactive","Read","Write"],"field_sources":{"name":0,"author":0,"license":0,"version":0,"homepage":0,"keywords":0,"repository":0,"capabilities":0},"extraction_version":1,"conflicts_or_errors":[]}}