security-scan · openai — Codex skill: security audit and installation

What security-scan does

The skill audits source code across a repository or a selected path, package, folder, or submodule. It investigates security questions against the code and produces a Codex Security report. The target is source code, not a change list.

This is a standard single-pass scan. It is not intended for pull requests, commits, branches, working-tree diffs, or deep multi-pass reviews. That distinction matters when you need findings tied specifically to a set of changes.

Before reviewing source, the workflow checks whether required scan capabilities are ready and considers the requested scope, threat model, and applicable SECURITY.md guidance. The described process uses Python and scripts shipped with the skill; the launch path depends on the Codex host. The source excerpt is truncated, so later workflow details are not covered here.