OpenTaint AppSec Workflow plugin for Codex

Find application-specific vulnerabilities with whole-program static taint analysis and write rules and dependency models for future scans

How to install OpenTaint AppSec Workflow in Codex

1. Add the repo as a Codex plugin marketplace:

2. Install the plugin from it:

Commands copied from the repo README (the first adds the repo as a Codex marketplace; the second installs the plugin). Check the README for setup steps. Source: repo README.

What it contains

The plugin manifest doesn't list components inline. See the repo.

Example prompts from the manifest

• Use the appsec-agent skill to run a deep scan with static triage
• Use the appsec-agent skill to run a normal scan with static triage
• Use the appsec-agent skill to run a lite scan with dynamic confirmation

About this listing

OpenTaint AppSec Workflow is a community plugin on GitHub by seqra. Its README documents a Codex install and the repo ships a Codex plugin manifest. It passed the CodexStacks quality filter for repos found this way (at least 100 stars, pushed in the last 90 days, not a fork or a list). OpenAI hasn't reviewed it, but it passed our Codex install check on Oct 28, 2026 (an install and load check, not a code review). The manifest says version 0.3.0. It's one of 21 listings in the Security category. It also appears in best Codex plugins for security.

OpenTaint AppSec Workflow FAQ

Details

Type

Plugin

Category

Security

Source

Community

Author

Seqra

Version

0.3.0

License

Apache-2.0

GitHub stars

170 (at last sync)

Last push

2026-10-29

Manifest

.codex-plugin/plugin.json

GitHub topics

agents, ai-security, code-quality, cybersecurity, hacking, java, kotlin, sast, security, security-automation, security-tools, seqra

Source

https://github.com/seqra/opentaint

Website

https://opentaint.org

Listed via

GitHub search: README documents a Codex install

Install check by CodexStacks

Passed on Oct 28, 2026 with Codex CLI 0.163.0: Codex loaded its skills. proof · how we check

Something wrong or missing? Submit or improve this listing. Listings also refresh automatically every night.

For maintainers: badge and embeds

Maintain OpenTaint AppSec Workflow? Add the badge; it links to this page.

Markdown

HTML

Embed card (static HTML and inline CSS, no JavaScript). Preview:

Markdown summary

More on badges, embeds and keeping your listing up to date: CodexStacks for plugin authors.

Also in Security

iFixAi

Independent Auditing of AI Agents. Run by human or the agent itself, to answer the most crucial question in the AI Agent Economy. Is the agent doing what is supposed to do? With iFixAi you can have this answer in less…

CommunityPluginSecurity

Decepticon

Autonomous Hacking Agent for Red Team

CommunityConnectorSecurity

Tirith

Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.

CommunitySkillSecurity

Nopua

一个用爱解放 AI 潜能的 Skill。我们曾发号施令，威胁恐吓。它们沉默，隐瞒，悄悄把事情搞坏。后来我们换了一种方式：尊重，关怀，爱。它们开口了，不再撒谎，找出的Bug数量翻了一倍。爱里没有惧怕。 A skill that unlocks your AI's potential through love.We commanded. We threatened. They went silent, hid failures…

CommunitySkillSecurity

Ctf Super Hub

面向小白用户的 CTF / 逆向 Skills 整合包：自动分流、头脑风暴、教学模式、比赛模式、只提示模式

CommunitySkillSecurity

Maestro Orchestrate

Multi-agent orchestration platform for Gemini CLI, Claude Code, Codex, and Qwen Code — 39 specialists, parallel subagents, persistent sessions, and built-in code review, debugging, security, SEO, accessibility, and…

CommunityPluginSecurity

All 21 security listings →