define-security-policy — Codex skill: what it does, how to install
Helps author, review, and update SECURITY.md files so Codex Security knows project boundaries, invariants, and out-of-scope targets.
npx skills add openai/plugins --skill define-security-policy -a codexWhat define-security-policy does
This skill writes and updates SECURITY.md files to guide the Codex Security scanner. It clarifies system boundaries, threat models, and required security properties for an entire repository or a single component. To discover active files, it executes launch_codex_security_mcp through a bundled Node runtime, filtering out Git metadata and ignoring policies larger than 1 MiB.
During review, the agent inspects source files, deployment notes, and tests as untrusted inputs. It asks at most three questions at once. It shows a complete diff before touching disk and never creates Git commits or branches without an explicit request. This skill is worth running when automated scanners flag irrelevant issues due to missing policy context.
What it helps with
- document threat models and trusted boundaries in SECURITY.md
- suppress scanner noise by recording accepted risks and exclusions
- resolve inherited policy chains across root and nested components
- verify existing security instructions against actual repository code
Example prompts for the agent
- Draft a root SECURITY.md policy for Codex Security
- Review existing security guidance against the code in backend/
- Update our security invariants and exclude third-party test fixtures
How to install define-security-policy
1Skills CLI (Vercel)
npx skills add openai/plugins --skill define-security-policy -a codex2Manually: put the files in place
.agents/skills/define-security-policy/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill define-security-policy -a claude-code2Manually: put the files in place
~/.claude/skills/define-security-policy/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/define-security-policy/
Manually: put the files in place
.cursor/skills/define-security-policy/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins define-security-policy2Manually: put the files in place
.github/skills/define-security-policy/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/define-security-policyManually: put the files in place
.devin/skills/define-security-policy/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set201
The whole set →Similar
Questions about define-security-policy
How to install define-security-policy in Codex?
Run npx skills add openai/plugins --skill define-security-policy in your terminal.
What does define-security-policy do?
It drafts or updates SECURITY.md guidance to tell Codex Security what assets matter, what invariants must hold, and which findings to ignore.
How does it handle nested security policies?
The skill evaluates policies from root to leaf directories. When guidance conflicts, the policy file closest to the reviewed code takes precedence.
