Skip to main content
affpapa.org
RU EN
skill CX Codex GP ChatGPT official · OpenAI

fix-finding — Codex skill: what it does, how to install

Resolves confirmed security vulnerabilities through targeted, validated patches. Useful when you need to close an exploit path without breaking existing APIs.

Install into Codex · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openai/plugins --skill fix-finding -a codex
Open on GitHub

What fix-finding does

This skill turns a specific vulnerability report into a minimal code fix. It begins by tracing the data path from input to sink. When delegation is available, an isolated read-only subagent inspects the security boundary. If the repository already protects the path, the skill reports no_change and avoids speculative edits.

After the patch is written, a second review subagent challenges the implementation. It looks for alternative bypasses and checks whether standard inputs now fail. The skill also handles Generate and Apply remediation stages within the Codex Security workbench.

Skip this skill for standard bug fixes or general code cleanup. Install it only when you handle explicit vulnerability remediation.

What it helps with

  • Trace tainted inputs from source to sink across repository boundaries
  • Generate minimal security fixes without altering unrelated functions
  • Verify patches against alternative bypass routes and edge cases
  • Prepare isolated unified diffs for Codex Security remediation flows

Example prompts for the agent

  • Fix this path traversal vulnerability and verify that existing file tests still pass.
  • Remediate the SSRF finding in our webhook handler with a minimal patch.
  • Generate a validated diff for the authorization bypass occurrence in the auth controller.

How to install fix-finding

1Skills CLI (Vercel)

npx skills add openai/plugins --skill fix-finding -a codex

2Manually: put the files in place

.agents/skills/fix-finding/SKILL.md

For all projects use ~/.agents/skills/

From the same set201

The whole set →
supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs remotion-render official Remotion Exports videos and static stills from Remotion projects using CLI commands. CX Codex GP ChatGPT 3installs figma-create-new-file official Figma Creates blank Figma, FigJam, or Slides files inside draft folders. It resolves planKey and editor types before invoking Figma MCP tools. CX Codex GP ChatGPT 6installs swiftui-performance-audit official OpenAI Pinpoints SwiftUI runtime issues like frame drops, unresponsive taps, and excessive view body computations. Works code-first and guides Instruments profiling. CX Codex GP ChatGPT 109installs swiftui-liquid-glass official OpenAI This skill helps build and review SwiftUI Liquid Glass interfaces for iOS 26+. Use it when adopting the API or checking fallbacks, interaction, and design fit. CX Codex GP ChatGPT 121installs swiftui-ui-patterns official OpenAI This skill helps build and refactor SwiftUI interfaces, from navigation and state to layouts and controls. Use it for new screens or changes to an existing project. CX Codex GP ChatGPT 114installs swiftui-view-refactor official OpenAI Refactors SwiftUI view files into clean, testable structures with dedicated subview types and proper Observation ownership. CX Codex GP ChatGPT 113installs ios-memgraph-leaks official OpenAI Captures and inspects iOS leaks from a simulator process or .memgraph. Useful for tracing retained objects and checking a fix with before-and-after evidence. CX Codex GP ChatGPT 1,054installs

Similar

aims-audit Alireza Rezvani Runs a six-question ISO/IEC 42001 internal audit check for AI Management Systems. Helps verify readiness before stage 1 audits or when onboarding models. Claude Code 31installs gdpr-audit-prep Alireza Rezvani Runs a six-question DPO interrogation citing GDPR articles. Prepares teams for annual privacy reviews, breach responses, and regulatory inquiries. Claude Code 28installs compliance-readiness Alireza Rezvani Runs a 6-question compliance officer interrogation to pressure-test compliance programs before audits or new framework adoption. Maps overlapping controls and flags gaps. Claude Code 27installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. Claude Code CX Codex Cursor +1 52,200installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. Claude Code CX Codex Cursor +1 69,400installs

Questions about fix-finding

How to install fix-finding in Codex?

Run npx skills add openai/plugins --skill fix-finding -a codex in your terminal. This adds the skill definition to .agents/skills/fix-finding/SKILL.md.

What does fix-finding do?

It investigates reported security issues, implements a minimal fix at the enforcement boundary, and validates that normal behavior stays intact.

When should you avoid using this skill?

Do not use it for standard code review, routine bug fixing, or broad repository scans. It activates only for confirmed or plausible security findings.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor