← All skills
codex-security
82 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By b-open-io/prompts (GitHub) · security · 15 stars · scanned at commit f4b302a
Run OpenAI's agentic security scanner (`@openai/codex-security`) over a repo, PR, or diff, then triage, patch, and gate on its findings. Use for 'run a codex security scan', 'find vulnerabilities in this PR', 'export findings as SARIF', 'fix that security finding', 'compare this scan to the last one', or when a pattern sweep came back thin. Not for dependency CVEs, secrets, or licenses (code-audit-scripts, bun audit).
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 4 places.
Show 1 more
Downloads and installs other software
The author does not mention this.
Found in 49 places.
Show 17 more
- modules/review/skills/codex-security/SKILL.md, line 86
npx @openai/codex-security scan . --model gpt-6-sol --effort xhigh --diff origin/main --max-cost 3 - modules/review/skills/codex-security/SKILL.md, line 87
npx @openai/codex-security scan . --model gpt-6-sol --effort xhigh --working-tree --max-cost 2 - modules/review/skills/codex-security/SKILL.md, line 90
npx @openai/codex-security scan . --model gpt-6-sol --effort xhigh --knowledge-base docs/threat-model.md - modules/review/skills/codex-security/SKILL.md, line 93
npx @openai/codex-security scan . --model gpt-6-sol --effort xhigh --mode deep --max-cost 20 - modules/review/skills/codex-security/SKILL.md, line 96
npx @openai/codex-security scan . --model gpt-6-sol --effort xhigh --dry-run - modules/review/skills/codex-security/SKILL.md, line 112
npx @openai/codex-security scans list . # history for this checkout - modules/review/skills/codex-security/SKILL.md, line 113
npx @openai/codex-security scans show SCAN_ID # config, results, coverage, artifacts - modules/review/skills/codex-security/SKILL.md, line 114
npx @openai/codex-security scans compare OLD_ID NEW_ID # new / persisting / reopened / resolved - modules/review/skills/codex-security/SKILL.md, line 115
npx @openai/codex-security findings false-positive OCCURRENCE_ID --reason "..." - modules/review/skills/codex-security/SKILL.md, line 116
npx @openai/codex-security export RESULTS_DIR --export-format sarif --output results.sarif - modules/review/skills/codex-security/SKILL.md, line 156
npx @openai/codex-security validate FINDINGS_JSON "Missing authz in src/routes.ts:18" --codex 'model="gpt-6-sol"' --effort xhigh - modules/review/skills/codex-security/SKILL.md, line 159
npx @openai/codex-security patch FINDINGS_JSON "Missing authz in src/routes.ts:18" --codex 'model="gpt-6-sol"' --effort xhigh - modules/review/skills/codex-security/SKILL.md, line 162
npx @openai/codex-security scan . --path src/routes.ts --model gpt-6-sol --effort xhigh --max-cost 2 - modules/review/skills/codex-security/SKILL.md, line 163
npx @openai/codex-security scans compare "$BEFORE_ID" "$AFTER_ID" - modules/review/skills/codex-security/SKILL.md, line 166
npx @openai/codex-security findings false-positive OCCURRENCE_ID --reason "..." - modules/review/skills/codex-security/references/cli-reference.md, line 30
npx @openai/codex-security --version - modules/review/skills/codex-security/references/cli-reference.md, line 31
npx @openai/codex-security info --json # package, plugin, runtime, defaults
and 29 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'codex-security' ] || [ -L ~/.agents/skills/'codex-security' ]; then echo 'A skill folder named codex-security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/b-open-io/prompts' "$d" && git -C "$d" checkout --quiet 'f4b302aadb0c99023b03e1f1b38ffed3697fbedf' -- 'modules/review/skills/codex-security' && mkdir -p ~/.agents/skills && cp -R "$d"/'modules/review/skills/codex-security' ~/.agents/skills/'codex-security' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'codex-security' ~/.claude/skills/'codex-security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for b-open-io/prompts shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/b-open-io/prompts/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | f4b302a | 82 |
| 2026-11-06 | f4b302a | 82 |