attack-path-analysis

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/attack-path-analysis/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable instruction skill with clean progressive disclosure and strong checklists. The primary drag is redundancy: the compact-diff-mode and no-receipts rules are repeated across several sections, and the batch workflow lacks an explicit post-submit verification loop.

Suggestions

State the compact-diff-mode tool-call rule and the 'no separate reports/receipts' constraint once in Artifact Resolution, then cross-reference it from Workflow, Output Contract, and Hard Rules instead of restating it 4-5 times.

Merge or cross-reference the overlapping scoping fields (exposure, identity/trust boundaries, reachability) that appear in both the Workflow step 3 list and the Scope/Counterevidence checklists to remove redundancy.

Add an explicit post-submit verification step after the batch record_candidate_attack_paths call (e.g. re-read the recorded candidates to confirm every eligible candidate has a decision) to close the batch validation gap.

Dimension	Reasoning	Score
Conciseness	The body is information-dense and does not pad with concepts Claude already knows, but the compact-diff-mode guidance and the 'no separate reports/receipts' rule are restated across Artifact Resolution, Workflow, Output Contract, and Hard Rules, which is more than minor trimmable redundancy.	3 / 5
Actionability	Concrete, executable guidance for an instruction-only skill: verbatim tool signatures (list_codex_security_candidates({scanId, cursor?, limit?}), record_candidate_attack_paths({...})), an exact output-contract field list, and specific checklists, with the minor gap of no inline worked example of a rendered fact block or receipt.	4 / 5
Workflow Clarity	A clear 8-step sequence is gated by explicit pre-finalization checklists (Scope, Counterevidence, Severity/Policy) and a counterevidence checkpoint, but there is no post-batch-submit verification or explicit validate->fix->retry loop for the batch record_candidate_attack_paths call.	4 / 5
Progressive Disclosure	Clear sectioned overview with well-signaled, one-level-deep references to real bundle files (references/severity-policy.md, references/attack-path-facts.md), and detailed policy/fact-rendering content is appropriately split into those files rather than inlined.	5 / 5
	Total	16 / 20 Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-bounded description with explicit positive and negative triggers and low conflict risk. Its main weakness is that the capability is embedded in the trigger clause rather than stated as a standalone 'what' sentence, and only two concrete actions are named.

Suggestions

Lead with a standalone declarative capability sentence (e.g. 'Turns validated security findings into explicit attack paths, calibrates severity, and decides reportability.') before the 'Use when' clause so the 'what' is stated independently of the trigger.

Add one or two more concrete actions (e.g. 'render attack-path facts' or 'apply the final policy-adjustment matrix') to broaden action coverage beyond trace-and-calibrate.

Dimension	Reasoning	Score
Specificity	Names the domain and two concrete actions ("trace a security finding from source to sink and calibrate severity") but stops there rather than listing several specific actions, matching the '1-2 concrete actions, not comprehensive' anchor.	3 / 5
Completeness	Both 'what' and 'when' are present and the 'when' is highly explicit with positive and negative triggers, but the capability is fused into the 'Use when' clause rather than stated as a standalone declarative sentence, so it does not cleanly match the anchor-5 structure.	4 / 5
Trigger Term Quality	Good natural keyword coverage for the security domain ("trace a security finding from source to sink", "calibrate severity", "security scan") plus a concrete negative-trigger list ("PR, commit, branch, patch, or repository scans"), with only a few synonyms (e.g. exploitability, reachability) missing.	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (the attack-path-analysis phase of a security scan) and explicitly excludes the broader scan triggers ("Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans"), giving minimal conflict risk.	5 / 5
	Total	16 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/attack-path-analysis/SKILL.md
Commit: d416fd5

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.