Codex Security workflows for security scans, analysis, and investigation. Skills cover security scans, diff scans, deep scans, threat modeling, finding triage, fix proposals and verification, vulnerability write-ups and patch-risk assessment. Listed in OpenAI's curated Codex marketplace (openai-curated); the manifest declares skills, an app connector and MCP server config.
Also available as
Install
- 1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Codex Security” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.
- 2Or install it in Codex
codex plugin add codex-security@openai-curatedStart a new Codex session afterwards. You can also run /plugins inside the CLI to browse and install interactively.
Skills 15
- Assess Patch Risk
Assess patch impact and merge risk
- Attack Path Analysis
Perform attack-path analysis for a security finding
- Deep Security Scan
Run a deeper security scan
- Define Security Policy
Define scoped SECURITY.md scan guidance
- Finding Discovery
Discover security findings
- Fix Security Finding
Fix and verify a given security finding
- Propose Security Hardening
Design evidence-backed security hardening options
- Security Diff Scan
Run security review on a Git diff
- Security Scan
Run repository or scoped-path security scan
- Threat Model
Build a repository threat model
- Track Findings
Track findings in Linear, Jira, GitHub issues, or draft advisories
- Triage Finding
Triage existing security findings from reports, GitHub, Jira, or Linear
- Validation
Validate a security finding
- Verify Fix
Verify security fixes without changing code
- Vulnerability Writeup
Write up a vulnerability into a polished, self-contained, source-backed report.
Things to ask
- “Run a Codex Security scan on this repository.”
- “Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch.”
- “Triage existing security findings against this repository.”
Disconnect or uninstall
- 1In ChatGPT
Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Codex Security in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.
- 2In Codex
codex plugin remove codex-security@openai-curated
Learn more
Codex Security alternatives
SuperpowersPlan, develop, and debug codeplugin · by Jesse Vincent · 294k stars