jobtrackingapp/automation/prompts/jobjakt-security/resources/CODEX_SKILLS_AND_TOOLS.md

Useful Codex Skills, security tooling and references (reviewed 2026-10-26)

Built-in Codex skills

• $skill-creator: official built-in creator for packaging repeatable security review procedures. This bundle includes a ready-to-use repo-local skill as a starting point. See https://learn.chatgpt.com/docs/build-skills.
• $skill-installer: can list/install curated skills; do not install arbitrary third-party executable skills without checking scripts/permissions. The old openai/skills GitHub README is now marked deprecated; use current Codex/plugin docs.
• The repo skill path .agents/skills/jobjakt-security-auditor/SKILL.md is automatically discovered when Codex is opened in a suitable folder. Explicitly invoke as $jobjakt-security-auditor if recognized; exact discovery varies with host/version.

Codex Security (confirmed installed in user's Codex environment; use as REQUIRED)

• Plugin installation/availability is user-confirmed, not verified by this document. Confirm its skills resolve in the specific Codex session and always log real scan results and saved paths. No additional installation is needed in the user's configured environment.
• Baseline source scan: Use $codex-security:security-scan to scan this repository for security vulnerabilities.
• Deep source scan: Use $codex-security:deep-security-scan to run a deep security scan of this repository. Deep means multiple independent source reviews, not a live penetration test; it can have significant token/runtime usage. Obtain owner approval before charges.
• Remediation change review: Use $codex-security:security-diff-scan to review changes from <base> to HEAD for security regressions. Do not modify the checkout.
• One finding at a time: Use $codex-security:fix-finding to fix finding <id> from <scan-report-path>. Validate the failure, propose the smallest safe fix, test it and preserve the proof gap.
• Independent verification: Use $codex-security:verify-fix to verify finding <id> against this checkout without changing files.
• Other helpful skills: $codex-security:define-security-policy, $codex-security:assess-patch-risk, $codex-security:propose-security-hardening. Verify current plugin skill catalog for Attack Path Analysis instead of guessing an invocation.
• Read https://learn.chatgpt.com/docs/security/plugin/scans , https://learn.chatgpt.com/docs/security/plugin/deep-scans , https://learn.chatgpt.com/docs/security/plugin/code-changes , https://learn.chatgpt.com/docs/security/plugin/fix-findings and https://learn.chatgpt.com/docs/security/plugin/changelog .
• See CODEX_SECURITY_WORKFLOW.md for when/why/how to run each workflow, explicit stop conditions, scan register and remaining manual testing scope.

Complementary scanners (not Codex Skills)

• Source patterns: Semgrep, CodeQL (when available and license/workflows fit).
• Secrets: Gitleaks or equivalent, safe redacted output, including repository history.
• Software dependencies / SBOM: native .NET/NuGet package auditing, npm audit, pip-audit or OSV-Scanner, CycloneDX/SPDX tools.
• Containers and IaC: Trivy, Docker Scout or equivalent; check actual images/Compose configs.
• Web API/browser: OWASP ZAP passive and approved capped active scans, plus Playwright negative tests. Avoid pointing active scanners at production.
• Python and LLM: Bandit for Python, schema tests, bounded prompt-injection fixture suite, and explicit review of Ollama/Docling exposure.
• Do not blindly run a copied scanner command: verify its current version/flags against local docs and current project runtime.

Methodology

• OWASP ASVS 5.0.0: https://asvs.owasp.org/
• OWASP WSTG 4.2: https://wstg.owasp.org/stable/4-Web_Application_Security_Testing/
• OWASP API Top 10 2023: https://owasp.org/API-Security/editions/2023/en/0x11-t10/
• OWASP LLM Top 10 2025: https://genai.owasp.org/llm-top-10/
• OpenAI Codex skills docs: https://learn.chatgpt.com/docs/build-skills
• Codex Security: https://learn.chatgpt.com/docs/security