# codex-security

Codex Security workflows for security scans, analysis, and investigation.

- **Kind:** plugin (installs as one bundle)
- **Owner:** openai
- **Source:** https://github.com/openai/codex-security (`plugins/codex-security`)
- **Pinned commit:** `64bb3607067f0530b06c3be4b687d4d0bfd8dc9a`
- **Page:** https://forefy.com/plugins/40b8edb9-71b8-5458-a34a-0935e261e99f
- **API (JSON):** https://forefy.com/api/asr/plugins/40b8edb9-71b8-5458-a34a-0935e261e99f

## Install

Ask your agent: `Install the codex-security plugin securely from: https://forefy.com/plugins/40b8edb9-71b8-5458-a34a-0935e261e99f globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/40b8edb9-71b8-5458-a34a-0935e261e99f/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (20)

- [assess-patch-risk](https://forefy.com/skills/1b59c00d-2e17-4744-9125-67e52092e1e9): Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, o…
- [attack-path-analysis](https://forefy.com/skills/9dcadda6-69dd-4ef4-8b08-af54befb037d): Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and…
- [check-skills](https://forefy.com/skills/40977234-1136-4bea-bad6-111cf7bcad16): Review agent skills before installation or use. Use when a user or security team wants to check a skill file, bundle, or collection for unsafe instructions, sc…
- [cloud-findings](https://forefy.com/skills/26496b42-11bc-4ad7-8eaf-b6c276cf3837): Read existing Codex Security Cloud findings, reports, recorded assignment and verification, and scan status from the connected account. Use for Cloud read requ…
- [deep-security-scan](https://forefy.com/skills/9234f496-281b-4ee2-9ff7-1b5e3012a2a9): Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit…
- [define-security-policy](https://forefy.com/skills/77f1087e-3a6a-403f-b69a-8801899fb3a1): Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out…
- [finding-discovery](https://forefy.com/skills/b4c1315d-dd96-476b-845a-7b4c6c367323): Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository…
- [fix-finding](https://forefy.com/skills/830fb0ed-ab84-44aa-9993-79a0db1f0608): Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or des…
- [propose-security-hardening](https://forefy.com/skills/914a9ddd-5f9f-45d0-a91a-d4176453f233): Develop evidence-backed structural security hardening proposals from disclosures, findings, source code, or Codex Security scans. Use for systemic improvements…
- [publish-findings](https://forefy.com/skills/447d4cce-aa0a-47fd-b16a-5d59f885647a): Preview and import scanner findings, including issues selected in the SonarQube plugin, into the local workbench or Codex Security Cloud.
- [resolve-dependency-alert](https://forefy.com/skills/4ee8b4ff-cc21-4816-a056-c6572a4c1cdc): Investigate a vulnerable dependency from a scanner alert, advisory, or SBOM match. Trace what pulls it in and determine whether it can be upgraded.
- [security-diff-scan](https://forefy.com/skills/9237477d-98f0-4b35-83c5-076a852a8d75): Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.
- [security-scan](https://forefy.com/skills/0011e1c7-57a0-481d-a47f-b74fe42518c9): Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the defa…
- [threat-model](https://forefy.com/skills/eec168a7-0152-44dd-acb2-65fbe58ce5c7): Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, up…
- [threat-model-visualize](https://forefy.com/skills/b461b9d3-a55d-48c6-8ab1-7046217a9907): Turn an existing threat model into an interactive architecture and threat-path explorer. Resolve simple requests for a target's last scan; do not perform a new…
- [track-findings](https://forefy.com/skills/9766bd4d-ca65-4f8d-9313-acfac280a53e): Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and revi…
- [triage-finding](https://forefy.com/skills/def738e3-665e-4ccc-8f06-69fe0b98bc78): Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, Git…
- [validation](https://forefy.com/skills/e089d10e-0d44-459d-b5ea-697930bf122e): Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings a…
- [verify-fix](https://forefy.com/skills/fd923e0b-6218-4974-87cb-b1b94fb697dd): Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing…
- [vulnerability-writeup](https://forefy.com/skills/babef7fd-8623-4019-9cce-3092da016309): Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained vulnerability reports with clearly supported cl…

## MCP servers it brings

- `codex-security`