Codex Security Review

Trust Score 77/100

Perform security-focused code reviews aligned to OWASP Top 10 and CWE patterns; produces grouped findings, risk summary, and remediation guidance.

triggers:security reviewowaspcwevulnerabilitycode auditsecurity-focused review

GitHub SKILL.md

What it does

A security-oriented review skill that inspects code changes for vulnerabilities mapped to OWASP Top 10 and CWE entries. It runs an adversarial review loop (init, poll, rebut, resume) and outputs structured findings (id, severity, cwe, owasp, evidence, suggested_fix) and a risk-summary to guide remediation.

When to use it

Use this skill for pull-request or branch reviews when changes touch authentication, crypto, SQL, user input handling, file uploads, or APIs. Also suitable for full-codebase audits or pre-merge security checks.

What's included

Scripts: none in this directory (has_references=true — see references for protocol and templates)
References: protocol.md and templates describing init/start/resume loops and error handling
Instructions: detailed runner commands, strict rules for stdin/json handling, looping/resume semantics, and how to parse review.blocks[] into actionable issues

Compatible agents

Designed for Codex-style harnesses and CLI runners that can execute the provided runner commands (Codex/Codex-impl-like agents).

Audit Summary

Security-focused code review skill that uses an adversarial debate loop with OWASP Top 10 and CWE alignment. No bundled scripts — relies entirely on an external Codex runner for execution. Well-structured workflow with clear steps, error handling, and cleanup protocols. Requires Codex infrastructure to function, limiting out-of-the-box usability.

Watch Out

Requires Codex runner infrastructure (RUNNER_PATH, SKILLS_DIR)
No standalone functionality without the runner
Shell variable interpolation in prompt templates has minor injection surface

Notes

Pure instruction skill with no scripts. Adversarial debate model for security review is an interesting approach. The skill is well-documented but entirely dependent on external Codex runner tooling, which limits its portability and standalone value.

Information

Repository: codex_skill
Stars: 67

Trust Score

Overall77

Security88

Code Quality62

Architecture70

Usefulness65

Related Skills

Reverse Engineer

Provides step-by-step guidance and best practices for binary reverse engineering: static analysis, dynamic tracing, disassembly, and documentation workflows for

Run Execute

Orchestrates execution of work items across modes (autopilot, confirm, validate) with scripted init/complete tooling, plan/test/report artifacts and strict gati

Sandbox0 Integration

Guidance and templates for integrating Sandbox0 sandboxing into AI agents — CLI/SDK patterns, templates, volumes, network policy, and deployment choices.

CTF Write-up Generator

Generate a concise, reproducible submission-style CTF writeup with a one-path solution script, metadata, and a short checklist for fast verification.

Codex Collab

Bridge Claude and Codex to run tasks, perform code reviews, and run background jobs for research or implementation workflows.

Azure External Attack Surface Management

Provides expert guidance for Azure External Attack Surface Management (EASM): quotas, configuration, integrations, and exporting inventory to analytics platform

Node.js Best Practices

Guidelines and decision-making for Node.js architecture, runtime, async patterns, security, validation, and testing to inform framework and system choices.

radar — Smart Contract AST & Security Analysis

Multi-framework AST generator and static analysis tool for smart contracts (Rust/Anchor/Stylus and Solidity/Foundry) with a template DSL for writing detection r

Back to Skills