Codex Security plugin for Codex
Codex Security packages reusable workflows for security scans, analysis, validation, and investigation across code, diffs, and related artifacts.
How to install Codex Security in Codex
codex plugin add codex-security@openai-curatedCommand format from the Codex CLI reference (codex plugin add <plugin[@marketplace]>); openai-curated is the marketplace name in OpenAI's catalog file. You need to be signed in to Codex. Source: Codex CLI reference.
Or in Codex CLI type /plugins and pick it from the OpenAI curated marketplace; in the ChatGPT desktop app, open the Plugins tab. Start a new session afterwards so the plugin's skills and tools load. (OpenAI plugin docs)
What it contains
Skills (15)
assess-patch-risk— Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and…attack-path-analysis— Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or…deep-security-scan— Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated…define-security-policy— Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.finding-discovery— Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or…fix-finding— Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.propose-security-hardening— Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic…security-diff-scan— Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.security-scan— Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep…threat-model— Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit…track-findings— Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.triage-finding— Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime…validation— Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.verify-fix— Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes…vulnerability-writeup— Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is…
MCP servers (1)
codex-security
App connectors (3)
linear— ChatGPT app connection (sign-in handled by the plugin)github— ChatGPT app connection (sign-in handled by the plugin)atlassian— ChatGPT app connection (sign-in handled by the plugin)
Example prompts from the manifest
- Run a Codex Security scan on this repository.
- Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch.
- Triage existing security findings against this repository.
About this listing
Codex Security is in OpenAI's official curated Codex plugin catalog, published by OpenAI. It shows up in the Codex CLI plugin browser (/plugins) and in the ChatGPT desktop app's Plugins tab. The catalog lists it for the Codex product only. From its files we found 15 skills, 1 MCP server, 3 app connectors. The manifest says version 0.1.32. It's one of 9 listings in the Security category. It also appears in best Codex plugins for security.
Get new Codex plugins like Codex Security every week
The weekly CodexStacks drop: what's new and updated in the directory, in one short email.
You'll get a confirmation email first. Unsubscribe anytime.
Codex Security FAQ
How do I install Codex Security in Codex?
Run codex plugin add codex-security@openai-curated (format from the Codex CLI reference). Or in Codex CLI type /plugins and pick it from the OpenAI curated marketplace; in the ChatGPT desktop app, open the Plugins tab. Start a new session afterwards so the plugin's skills and tools load.
Is Codex Security an official Codex plugin?
Yes. Codex Security is in OpenAI's official curated Codex plugin catalog (marketplace openai-curated), published by OpenAI. It appears in the Codex CLI plugin browser and the ChatGPT desktop app's Plugins tab.
What does Codex Security include?
From its files in OpenAI's plugin repo, Codex Security includes 15 skills, 1 MCP server, 3 app connectors: assess-patch-risk, attack-path-analysis, deep-security-scan, define-security-policy, finding-discovery, fix-finding….
Details
- Type
- Plugin
- Category
- Security
- Source
- Official OpenAI curated
- Publisher
- OpenAI
- Version
- 0.1.32
- License
- Proprietary
- Sign-in
- Asks you to connect/sign in the first time you use it
- Availability
- Codex only (per the catalog's products field)
- Keywords
- security, code-review, diff-review, appsec, threat-modeling
- Source
- https://github.com/openai/plugins/tree/main/plugins/codex-security
- Website
- https://openai.com/
- Listed in
- OpenAI catalog file
- Tested by CodexStacks
- Not yet
Something wrong or missing? Submit or improve this listing. Listings also refresh automatically every night.
For maintainers: badge and embeds
Maintain Codex Security? Add the badge; it links to this page.
Markdown
[](https://codexstacks.com/p/codex-security/)HTML
<a href="https://codexstacks.com/p/codex-security/"><img src="https://codexstacks.com/badge.svg" alt="Listed on CodexStacks" width="172" height="28"></a>Embed card (static HTML and inline CSS, no JavaScript). Preview:
<a href="https://codexstacks.com/p/codex-security/" style="display:block;max-width:380px;box-sizing:border-box;padding:14px 16px;border:1px solid #3a2c26;border-radius:12px;background:#0d0b0a;color:#f3ece6;font:14px/1.45 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;text-decoration:none"><span style="display:block;font-size:16px;font-weight:700;color:#f3ece6">Codex Security</span><span style="display:block;margin:2px 0 8px;font-size:12px;color:#b5a9a1">Official Codex plugin · 15 skills, 1 MCP server, 3 app connectors</span><span style="display:block;margin:0 0 10px;color:#ddd3cc">Codex Security packages reusable workflows for security scans, analysis, validation, and investigation across code…</span><span style="font-size:12px;font-weight:600;color:#ffb347">View on CodexStacks →</span></a>Markdown summary
**[Codex Security on CodexStacks](https://codexstacks.com/p/codex-security/)**: Official Codex plugin with 15 skills, 1 MCP server, 3 app connectors. Install: `codex plugin add codex-security@openai-curated`More on badges, embeds and keeping your listing up to date: CodexStacks for plugin authors.
Also in Security
maestro-orchestrate
Multi-agent orchestration platform for Gemini CLI, Claude Code, Codex, and Qwen Code — 39 specialists, parallel subagents, persistent sessions, and built-in code review, debugging, security, SEO, accessibility, and compliance tools
Stata MCP
The official working package of MCP-for-Stata plugin, including mcp config and stata-skill.
codex-guard
Quality gate for AI/Codex-generated pull requests: blocks TODO leftovers, leaked secrets, sloppy commits and red CI before they reach main.
cti-skills
Cyber Threat Intelligence Skills for each stage of the CTI Lifecycle.
repopilot
Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server, and coding-agent plugins.
Trident-SecOps-Skills
A curated collection of AI SecOps 24 SKILL.md capabilities for security work offensive security, SOC and detection engineering, cloud and Kubernetes hardening, DFIR, threat intel, secure programming, reverse engineering, prompt improvement, and multilingual communication.