[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AC4NH7SCAS7CXHQQEPNHNQ":3,"skill-same:01M6AC4NH7SCAS7CXHQQEPNHNQ":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6AC4NH7SCAS7CXHQQEPNHNQ","deep-security-scan",null,"Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit, branch or working tree, use security-diff-scan.","openai\u002Fcodex-security","openai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4","01M6AC29YGCR4S2NTJFV0G8B81","OpenAI","01M6AC4B22Q8KPN8SGEAJYRB0N",11593,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fdeep-security-scan\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"security","deep security scan","deep","scan","security scan","when","standard security","standard","repository","audit","requests","changes","multi","commit","use","scoped","for","diff","pr","branch","tree","run","2026-11-10 10:12:30",false,"---\nname: deep-security-scan\ndescription: Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit, branch or working tree, use security-diff-scan.\n---\n\n# Deep Security Scan\n\nThe host runs Standard audits and merges their findings. Workers in the same scan can exchange investigation leads and verify each other’s evidence. Later passes receive the titles and locations already reported. The host stops when consecutive audits add nothing new or the configured scan or time limit is reached. Its final report includes every accepted audit.\n\n1. Resolve the authorized target and scope. For a scoped directory use that directory as `targetPath` and `scope: \".\"`. For a continuation, call `get_codex_security_scan_context` with its `scanId` and supplied `handoffClaimToken`. Use its saved identity and scope. If its mode is Standard or diff, continue with the corresponding scan skill. Follow `..\u002F..\u002Freferences\u002Fscan-prologue.md` for source access and context updates.\n2. For a new target, call `inspect_codex_security_setup({ targetPath, scope: \".\", mode: \"deep\", projectConfigPath? })`. Show the effective settings and their sources. `max_discovery_runs` caps the total number of Standard scans, including when several run together. Pass a project file only when the user selected it. Existing scans use their saved configuration.\n3. For a newly launched native scan with a supplied scan ID, inspect `otherRunningDeepScans` in the result of `get_codex_security_scan_context` once. Target-based setup previews have no scan ID. If another Deep scan is active, show its target, phase and human-friendly start time. Explain the additional CPU, memory and token use. Offer **Cancel (Recommended)** and **Continue** using `request_user_input`, then `request_codex_security_user_input` or plain chat if unavailable. Wait for an explicit choice. A dismissed dialog is not a cancellation. Cancel only the new scan if requested.\n4. Follow `..\u002F..\u002Freferences\u002Faccess-advisory.md`, then call `start_codex_security_deep_scan({ scanId, handoffClaimToken? })` for an existing scan or `start_codex_security_deep_scan({ targetPath, scope: \".\", userContext?, projectConfigPath? })` for a new target. Reuse the project file selected at setup. Await the tool. If the tool runner returns a running cell ID, wait on that cell until it returns the scan result. If the connection closes, rejoin with the same arguments. Report a terminal failure with its saved results. For a policy refusal, identify the worker from its saved error when available. On explicit cancellation call `cancel_codex_security_scan({ scanId })` from the owning thread.\n5. For an SDK-owned scan, return the host's scan ID and manifest path so the SDK can finalize it. When the tool returns `completion`, link its generated `report.md` and canonical artifacts. Use `completion.scan.usage` and any separate cost estimate to report usage per `..\u002F..\u002Freferences\u002Ffinal-report.md`. Distinguish a completed audit with zero findings from a deadline reached before any audit completed.\n","# Deep Security Scan\n\nThe host runs Standard audits and merges their findings. Workers in the same scan can exchange investigation leads and verify each other’s evidence. Later passes receive the titles and locations already reported. The host stops when consecutive audits add nothing new or the configured scan or time limit is reached. Its final report includes every accepted audit.\n\n1. Resolve the authorized target and scope. For a scoped directory use that directory as `targetPath` and `scope: \".\"`. For a continuation, call `get_codex_security_scan_context` with its `scanId` and supplied `handoffClaimToken`. Use its saved identity and scope. If its mode is Standard or diff, continue with the corresponding scan skill. Follow `..\u002F..\u002Freferences\u002Fscan-prologue.md` for source access and context updates.\n2. For a new target, call `inspect_codex_security_setup({ targetPath, scope: \".\", mode: \"deep\", projectConfigPath? })`. Show the effective settings and their sources. `max_discovery_runs` caps the total number of Standard scans, including when several run together. Pass a project file only when the user selected it. Existing scans use their saved configuration.\n3. For a newly launched native scan with a supplied scan ID, inspect `otherRunningDeepScans` in the result of `get_codex_security_scan_context` once. Target-based setup previews have no scan ID. If another Deep scan is active, show its target, phase and human-friendly start time. Explain the additional CPU, memory and token use. Offer **Cancel (Recommended)** and **Continue** using `request_user_input`, then `request_codex_security_user_input` or plain chat if unavailable. Wait for an explicit choice. A dismissed dialog is not a cancellation. Cancel only the new scan if requested.\n4. Follow `..\u002F..\u002Freferences\u002Faccess-advisory.md`, then call `start_codex_security_deep_scan({ scanId, handoffClaimToken? })` for an existing scan or `start_codex_security_deep_scan({ targetPath, scope: \".\", userContext?, projectConfigPath? })` for a new target. Reuse the project file selected at setup. Await the tool. If the tool runner returns a running cell ID, wait on that cell until it returns the scan result. If the connection closes, rejoin with the same arguments. Report a terminal failure with its saved results. For a policy refusal, identify the worker from its saved error when available. On explicit cancellation call `cancel_codex_security_scan({ scanId })` from the owning thread.\n5. For an SDK-owned scan, return the host's scan ID and manifest path so the SDK can finalize it. When the tool returns `completion`, link its generated `report.md` and canonical artifacts. Use `completion.scan.usage` and any separate cost estimate to report usage per `..\u002F..\u002Freferences\u002Ffinal-report.md`. Distinguish a completed audit with zero findings from a deadline reached before any audit completed.\n",{"name":5,"description":7},"main","14176380df0adaa305a3a8a607afa696bc869b63","plugins\u002Fcodex-security\u002Fskills\u002Fdeep-security-scan",920,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security","https:\u002F\u002Fdevelopers.openai.com\u002Fcodex\u002Fsecurity","https:\u002F\u002Fgithub.com\u002Fopenai","https:\u002F\u002Fopenai.com\u002F","2026-11-12 03:18:36",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add openai\u002Fcodex-security --skill deep-security-scan",{"tool":61,"command":62},"bunx","bunx skills add openai\u002Fcodex-security --skill deep-security-scan",{"tool":64,"command":65},"pnpm","pnpm dlx skills add openai\u002Fcodex-security --skill deep-security-scan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fdeep-security-scan\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"agents\u002Fopenai.yaml","REFERENCE","参考文档",192,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fdeep-security-scan\u002Fagents\u002Fopenai.yaml",[76,98,119,131,152,166],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":41},"01M6AC5YCQRMA998JYF1YQZ22X","vulnerability-writeup","Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained vulnerability reports with clearly supported claims. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fvulnerability-writeup\u002FSKILL.md",[],[83,84,85,19,86,87,88,23,33,89,90,22,91,92,93,94,35,95,96,97],"vulnerability writeup","vulnerability","codex","notes","code","codex security","campaign","reports","self","with","codex security scan","claims","source","self-contained","source code",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":41},"01M6AC5VVAAEE1N7RD44GM74B8","verify-fix","Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fverify-fix\u002FSKILL.md",[],[105,106,107,19,87,108,109,110,84,33,111,112,113,29,114,35,30,115,116,117,24,118],"verify fix","verify","fix","validation","verification","running tests","only","do","tests","implementing","fixes","candidate","invoke","running",{"skillNo":120,"name":108,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":41},"01M6AC5SF5X4MYQ8YSTMWMCT8S","Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fvalidation\u002FSKILL.md",[],[108,85,19,125,32,37,23,27,38,33,126,112,22,127,128,129,35,116,130,24],"valid","patch","as","trigger","more","phase",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":41},"01M6AC5PS8CWNQPC4JP6DH1MFQ","triage-finding","Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime validation, or fixes.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Ftriage-finding\u002FSKILL.md",[],[138,139,140,19,141,142,143,87,108,144,27,145,33,146,90,147,112,148,149,150,35,115,151],"triage","triage finding","github","policy","jira","runtime validation","linear","discovery","evidence","scanner","imported","runtime","duplicate","static",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":41},"01M6AC5M0N76KYA78936Q7VV34","track-findings","Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Ftrack-findings\u002FSKILL.md",[],[159,160,140,85,19,142,161,162,144,88,33,163,112,164,150,165,35,115],"track findings","track","github issues","issues","issue","draft","batches",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":41},"01M6AC5GTW07GPK3T0D9S4EDXZ","threat-model","Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002Fplugins\u002Fcodex-security\u002Fskills\u002Fthreat-model\u002FSKILL.md",[],[173,174,175,85,19,32,37,176,177,23,178,38,33,126,112,22,127,128,179,35,130,24],"threat model","model","threat","create","update","threat-modeling","persist"]