deep-security-scan

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent discovery passes over one resolved scope with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation, attack-path analysis, canonical JSON completion, and generated reporting once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/deep-security-scan/SKILL.md

Quality

Content

45%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The workflow is clearly sequenced with strong validation checkpoints, but the body is far too verbose with heavily repeated invariants and it critically relies on reference files that do not exist in the bundle, leaving it both bloated and incomplete.

Suggestions

Ship the referenced bundle files (config-preflight.md, security-guidance.md, final-report.md, finding-detail-fields.md) under references/, or inline only the essential parts so the skill is self-contained rather than depending on missing paths.

Deduplicate the orchestration invariants — the six-worker rule, terminal-state conditions, and no-early-finalization rules each appear across three to five sections; consolidate them into one 'Non-Negotiable Invariants' block and reference it.

Replace placeholder-heavy abstract directives in Shared Setup and the Centralized Tail with concrete, copy-paste-ready commands and a worked affected_locations example so the actionability matches the clarity of the workflow sequencing.

Dimension	Reasoning	Score
Conciseness	At ~549 lines the body is a dense wall of orchestration prose with heavy repetition of invariants (e.g. the six-worker rule and terminal-state conditions restated across Setup, Non-Negotiable Invariants, Deep Discovery Loop, Required Round-Transition Checklist, Worker Isolation, and Failure Handling), which pads the context with restated guidance Claude could infer from a tighter spec.	1 / 3
Actionability	It gives concrete commands in places (generate_rank_input.py invocations, finalize_scan_contract.py) and a copy-paste worker brief, but most guidance is abstract orchestration directives with placeholders like '<context_dir>' and '$codex-security:phase' rather than fully executable steps, leaving key details unresolved without the missing reference files.	2 / 3
Workflow Clarity	The multi-phase flow is explicitly sequenced (Shared Setup → Deep Discovery Loop → Required Round-Transition Checklist → Semantic Merge → Canonical Discovery Outputs → Exhaustive Scan Support Artifact Assembly → Centralized Tail → Final Output Rules), with numbered checklists, explicit validation/idle checkpoints, and a detailed Failure Handling section that defines repair and retry feedback loops.	3 / 3
Progressive Disclosure	The body repeatedly points to ../../references/*.md files (config-preflight.md, security-guidance.md, final-report.md, finding-detail-fields.md), but no references/, scripts/, or assets/ directories exist, so those references are broken and the SKILL.md is effectively a monolithic wall of text that cannot offload its detail as intended.	1 / 3
	Total	7 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with explicit triggers, comprehensive concrete actions, and clear anti-triggers that carve out a distinct niche. It does not pad with buzzwords or vague language.

Dimension	Reasoning	Score
Specificity	It names many concrete actions: 'repeated independent discovery passes', 'worker-specific threat models', 'semantically merge candidates', 'synthesize one canonical validation threat model', 'validation, attack-path analysis, canonical JSON completion, and generated reporting' — a comprehensive list of specific actions.	3 / 3
Completeness	It opens with an explicit 'Use when the user asks for...' trigger and then states what the skill does, clearly answering both 'when' and 'what'.	3 / 3
Trigger Term Quality	Natural user phrasing is well covered ('deep', 'exhaustive', 'multi-pass', 'variance-reducing', 'repository-wide', 'scoped-path'), and explicit anti-triggers ('PRs, commits, branch diffs, or working-tree diffs') give good coverage of terms a user would actually say.	3 / 3
Distinctiveness Conflict Risk	The Codex Security deep-scan niche is sharply bounded by both the positive triggers and the explicit 'Do not use for PRs, commits, branch diffs, or working-tree diffs' exclusion, making conflict with adjacent security skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (554 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: openai/plugins
Path: plugins/codex-security/skills/deep-security-scan/SKILL.md
Commit: 11c74d6

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.