Skip to main content
affpapa.org
RU EN
skill CX Codex GP ChatGPT official · OpenAI

verify-fix — Codex skill: what it does, how to install

Confirms whether a security patch actually removes a reported vulnerability. The skill runs strictly in read-only mode and outputs structured JSON without touching your code.

Install into Codex · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openai/plugins --skill verify-fix -a codex
Open on GitHub

What verify-fix does

This skill activates only on an explicit request such as $verify-fix. It avoids triggering during routine code reviews or everyday test suites. Full repo scans are out of scope.

All checks stay read-only. The tool never alters files, commits patches, or touches issue trackers. It maps the exploit path toward sensitive sinks while watching for moved routines and nearby guards. Existing reproducers run only when they require zero workspace modifications.

The final report arrives as a single JSON object with fixed, still_vulnerable, or inconclusive statuses. If repro checks need local file modifications, the tool marks the finding inconclusive. It never masks missing proof.

What it helps with

  • verify that a patched vulnerability cannot be reached
  • trace exploit paths across refactored functions
  • ensure a security control keeps legitimate features working
  • generate a structured JSON verdict with concrete proof

Example prompts for the agent

  • Run $verify-fix to confirm finding SEC-101 is resolved in this checkout.
  • Verify with verify-fix whether the patch closes the SQL injection path.

How to install verify-fix

1Skills CLI (Vercel)

npx skills add openai/plugins --skill verify-fix -a codex

2Manually: put the files in place

.agents/skills/verify-fix/SKILL.md

For all projects use ~/.agents/skills/

Step by step, with commands for each platform: Codex skills: how to install, where they live, how to call them

Questions about verify-fix

How do I install verify-fix in Codex?

Run npx skills add openai/plugins --skill verify-fix in your terminal. You can also target Codex directly with npx skills add openai/plugins --skill verify-fix -a codex.

What does verify-fix do?

It determines whether a designated security finding is remediated in your active checkout. The inspection is read-only and outputs a structured JSON report.

When does verify-fix report an inconclusive status?

A finding receives inconclusive if the repository diverges, context is missing, or test checks cannot execute without modifying files. The skill requires verifiable evidence before marking a bug fixed.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs

From the same set528

The whole set →
hyperframes-cli This skill runs HyperFrames projects from setup to video output, with checks for composition layout, browser preview, transcription, and speech generation. CX Codex GP ChatGPT 2installs subtitles Burns timed captions onto finished videos using Whisper speech recognition. Useful when automated video pipelines need burned-in text without manual timing. CX Codex GP ChatGPT 2installs upgrading-expo Walks the agent through an Expo SDK upgrade: install commands, diagnostics, cache cleanup and broken dependency fixes. CX Codex GP ChatGPT 2installs building-native-ui A Codex skill for building Expo Router interfaces with guidance on routes, styling, components, animation, and native tabs. CX Codex GP ChatGPT 2installs building-mcp-server-on-cloudflare A skill that walks the agent through building a remote MCP server on Cloudflare Workers: tools, OAuth, deployment. Useful when you need to expose your own functions over MCP. CX Codex GP ChatGPT 2installs building-ai-agent-on-cloudflare Generates Cloudflare Agents SDK code for edge deployment on Workers and Durable Objects. Handles persistent state, WebSockets, and background scheduling. CX Codex GP ChatGPT 2installs vercel-connect Guides Codex and ChatGPT to fetch scoped OAuth tokens for Slack, GitHub, Snowflake, and MCP servers using Vercel OIDC. CX Codex GP ChatGPT 1installs knowledge-update Injects up-to-date Vercel platform facts into the session and overrides stale model knowledge. Useful when your agent still reaches for Edge Functions or vercel.json. CX Codex GP ChatGPT 1installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor