attack-path-analysis — Codex skill: what it does, how to install
Evaluates plausible security findings in Codex and ChatGPT, traces paths from source to sink, and calibrates severity against the repository threat model.
npx skills add openai/plugins --skill attack-path-analysis -a codexWhat attack-path-analysis does
This skill activates during the attack path phase of a security scan or on explicit user request. It takes validated or plausible candidates and maps them against the repository threat model. The agent examines entry points, trust boundaries, and sensitive data handling without inventing unsupported exploit chains. Every path relies strictly on repository evidence.
Before confirming a finding, the skill searches for counterevidence across the codebase. If repository context shows an issue is admin-only, internal, or out of scope, the finding is suppressed or adjusted. It requires an existing per-scan threat model and potential findings to operate. Network access is disabled by default and occurs only if explicitly granted.
Security engineers auditing code in Codex should use this skill to weed out false positives. Do not use it as a primary scanner for entire branches or pull requests.
What it helps with
- trace security findings from entry point to vulnerable sink
- calibrate severity and likelihood using repository evidence
- verify counterevidence to discard false positives
- map affected code against the repository threat model
Example prompts for the agent
- Trace this security finding from source to sink and calibrate severity against our threat model
- Analyze attack paths for reportable candidates and check repository counterevidence
How to install attack-path-analysis
1Skills CLI (Vercel)
npx skills add openai/plugins --skill attack-path-analysis -a codex2Manually: put the files in place
.agents/skills/attack-path-analysis/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill attack-path-analysis -a claude-code2Manually: put the files in place
~/.claude/skills/attack-path-analysis/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/attack-path-analysis/
Manually: put the files in place
.cursor/skills/attack-path-analysis/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins attack-path-analysis2Manually: put the files in place
.github/skills/attack-path-analysis/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/attack-path-analysisManually: put the files in place
.devin/skills/attack-path-analysis/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set201
The whole set →Similar
Questions about attack-path-analysis
How do I install attack-path-analysis in Codex?
Run npx skills add openai/plugins --skill attack-path-analysis in your project root. Codex places the definition file at .agents/skills/attack-path-analysis/SKILL.md.
What does attack-path-analysis do?
It validates potential security findings by building factual attacker stories from source to sink. It tests candidates against repository counterevidence and assigns severity based on the threat model.
Can attack-path-analysis run as a standalone repository scanner?
No, it is not designed to trigger full scans of repositories, pull requests, or commits. It only analyzes specific candidates during an existing security workflow or when explicitly requested.
