Skip to main content
affpapa.org
RU EN
skill CX Codex GP ChatGPT official · OpenAI

validation — Codex security skill: findings and installation

This skill checks whether candidate security findings hold up. Use it to validate findings from discovery, not to start a full repository scan.

Install into Codex · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openai/plugins --skill validation -a codex
Open on GitHub

What validation does

For each finding, the skill traces the claimed input to the suspected code path and identifies its preconditions. When a bounded reproduction is feasible, it can use a focused test, PoC, or application interface. Otherwise, it assesses the path from code and records supporting evidence, counterevidence, and proof gaps.

In workbench-backed diff mode, a scanId lets the skill load the candidate set and submit all dispositions in one tool call. Other workflows save a visible report and a validation receipt; PoCs, crafted inputs, and logs go in the artifact directory. The skill uses shared artifact paths and repository references from openai/plugins.

Install it when specific findings need validation. It is not the trigger for a full PR, commit, branch, or repository scan.

What it helps with

  • trace attacker-controlled input to a suspected sink
  • reproduce a candidate vulnerability with a focused test or PoC
  • check whether the required preconditions are reachable
  • record evidence and proof gaps for each finding

Example prompts for the agent

  • Check whether this candidate security finding is valid.
  • Trace this input to the suspected sink and try a minimal reproduction.
  • Validate every candidate from the diff scan and submit the dispositions.

How to install validation

1Skills CLI (Vercel)

npx skills add openai/plugins --skill validation -a codex

2Manually: put the files in place

.agents/skills/validation/SKILL.md

For all projects use ~/.agents/skills/

From the same set201

The whole set →
supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs remotion-render official Remotion Exports videos and static stills from Remotion projects using CLI commands. CX Codex GP ChatGPT 3installs figma-create-new-file official Figma Creates blank Figma, FigJam, or Slides files inside draft folders. It resolves planKey and editor types before invoking Figma MCP tools. CX Codex GP ChatGPT 6installs swiftui-performance-audit official OpenAI Pinpoints SwiftUI runtime issues like frame drops, unresponsive taps, and excessive view body computations. Works code-first and guides Instruments profiling. CX Codex GP ChatGPT 109installs swiftui-liquid-glass official OpenAI This skill helps build and review SwiftUI Liquid Glass interfaces for iOS 26+. Use it when adopting the API or checking fallbacks, interaction, and design fit. CX Codex GP ChatGPT 121installs swiftui-ui-patterns official OpenAI This skill helps build and refactor SwiftUI interfaces, from navigation and state to layouts and controls. Use it for new screens or changes to an existing project. CX Codex GP ChatGPT 114installs swiftui-view-refactor official OpenAI Refactors SwiftUI view files into clean, testable structures with dedicated subview types and proper Observation ownership. CX Codex GP ChatGPT 113installs ios-memgraph-leaks official OpenAI Captures and inspects iOS leaks from a simulator process or .memgraph. Useful for tracing retained objects and checking a fix with before-and-after evidence. CX Codex GP ChatGPT 1,054installs

Similar

aims-audit Alireza Rezvani Runs a six-question ISO/IEC 42001 internal audit check for AI Management Systems. Helps verify readiness before stage 1 audits or when onboarding models. Claude Code 31installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. Claude Code CX Codex Cursor +1 52,200installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. Claude Code CX Codex Cursor +1 69,400installs

Questions about validation

How do I install validation in Codex?

Run npx skills add openai/plugins --skill validation -a codex. The skill file is at .agents/skills/validation/SKILL.md.

What does the validation skill do?

It assesses candidate security findings by tracing the claimed input, vulnerable sink, and preconditions. When feasible, it attempts a focused reproduction; otherwise, it records a code-based assessment and proof gaps.

Can I use validation to scan a whole repository?

No. It is for validating candidate findings after discovery or in response to a direct request to assess specific findings, not for primary PR, commit, branch, or repository scans.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor