# verify-fix

Confirms whether a security patch actually removes a reported vulnerability. The skill runs strictly in read-only mode and outputs structured JSON without touching your code.

- skill · `type=skill` · Codex, ChatGPT · 2 installs · ★ 7604
- Author: OpenAI · official OpenAI repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/openai/plugins/tree/HEAD/plugins/codex-security/skills/verify-fix/SKILL.md
- Updated: 2026-10-08
- HTML: https://affpapa.org/en/nevibecode/skills/verify-fix

## What it does

This skill activates only on an explicit request such as `$verify-fix`. It avoids triggering during routine code reviews or everyday test suites. Full repo scans are out of scope.

All checks stay read-only. The tool never alters files, commits patches, or touches issue trackers. It maps the exploit path toward sensitive sinks while watching for moved routines and nearby guards. Existing reproducers run only when they require zero workspace modifications.

The final report arrives as a single JSON object with `fixed`, `still_vulnerable`, or `inconclusive` statuses. If repro checks need local file modifications, the tool marks the finding `inconclusive`. It never masks missing proof.

## Install

### Codex (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add openai/plugins --skill verify-fix -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/verify-fix/SKILL.md` — For all projects use ~/.agents/skills/

### Claude Code

1. **Skills CLI (Vercel)**
```bash
npx skills add openai/plugins --skill verify-fix -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/verify-fix/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/verify-fix/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/verify-fix/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install openai/plugins verify-fix
```

2. **Manually: put the files in place**
- File: `.github/skills/verify-fix/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/verify-fix
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/verify-fix/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/openai/plugins/tree/HEAD/plugins/codex-security/skills/verify-fix/SKILL.md

## When to use it
- verify that a patched vulnerability cannot be reached
- trace exploit paths across refactored functions
- ensure a security control keeps legitimate features working
- generate a structured JSON verdict with concrete proof

## Example prompts
- Run `$verify-fix` to confirm finding SEC-101 is resolved in this checkout.
- Verify with `verify-fix` whether the patch closes the SQL injection path.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs

From the same set: [openai/plugins](https://affpapa.org/en/nevibecode/by/openai/plugins.md) — 528 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md