security-scan

Use for a standard, single-pass security audit of an entire repository or a scoped path, package folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR/commit/branch/working-tree diffs, or for deep, multi-pass, or variance-reducing scans.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with a clear gated phase sequence, but it is verbose with repeated rules and its progressive disclosure is undermined by missing or mismatched reference files and paths that resolve outside the bundle.

Suggestions

De-duplicate the validation/attack-path receipt and goal-closure rules: state them once in Goal Setup or Hard Rules and reference that single source instead of repeating them across Setup Workspace Routing, Capability Preflight, and Hard Rules.

Fix the reference paths: correct ../../references/ to a path that resolves inside the bundle, and align cited filenames with the actual bundle files (e.g. scan-artifacts.md -> scan-artifacts-and-ledger.md), or restore the missing files (config-preflight.md, final-report.md, security-guidance.md, shared-hard-rules.md, finding-detail-fields.md).

Consolidate the Codex app routing into a compact decision table or numbered branch rather than the current long prose paragraph to cut token cost without losing the gating logic.

Dimension	Reasoning	Score
Conciseness	At ~159 lines the body restates the same ledger-receipt, goal-closure, and app-wait rules multiple times (Setup Workspace Routing, Capability Preflight, Goal Setup, and Hard Rules repeat the validation/attack-path receipt requirements), so it could be substantially tightened despite otherwise assuming Claude's competence.	2 / 3
Actionability	It gives concrete, executable orchestration: exact phase order, named subagent ownership with concrete shard/ledger constraints, explicit dispositions (reportable/suppressed/not_applicable/deferred), and exact artifact paths. As an instruction-only skill, the absence of code is not penalized because the guidance is directly actionable.	3 / 3
Workflow Clarity	The five-phase sequence is linear with explicit gating checkpoints (preflight must return ready before goal setup; do not read ahead until a phase completes; receipt-based closure before final reporting) and clear feedback loops for preflight remediation.	3 / 3
Progressive Disclosure	The body signals one-level-deep references, but bundle verification shows most cited files (config-preflight.md, scan-artifacts.md, final-report.md, security-guidance.md, shared-hard-rules.md, finding-detail-fields.md) are missing, the ../../references/ path resolves outside the bundle, and a cited name (scan-artifacts.md) does not match the actual scan-artifacts-and-ledger.md, so navigation is partly broken rather than cleanly organized.	2 / 3
	Total	10 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that gives a clear "Use for" trigger, positive scope, and explicit negative boundaries. The only weakness is that it enumerates scope variants rather than multiple distinct concrete actions.

Dimension	Reasoning	Score
Specificity	The description names a concrete domain ("security audit of an entire repository or a scoped path, package folder, or submodule") but the only action is "audit" with scope variants, not the multiple distinct actions the top anchor expects.	2 / 3
Completeness	It explicitly answers both what ("single-pass security audit of an entire repository or a scoped path...") and when ("Use for a standard, single-pass security audit... This is the default repository scan") with an explicit "Use for..." trigger and exclusions.	3 / 3
Trigger Term Quality	It uses natural user phrasing ("security audit", "repository", "PR/commit/branch/working-tree diffs") plus useful negative triggers ("Do not use for...") that a user would actually say when deciding on this skill.	3 / 3
Distinctiveness Conflict Risk	The niche is sharply drawn as the default single-pass repo scan and explicitly excludes diff scans and deep/multi-pass scans, making it unlikely to trigger for a conflicting skill.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/security-scan/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.