Skip to main content
affpapa.org
RU EN
skill CX Codex GP ChatGPT official · OpenAI

vulnerability-writeup — Codex skill: what it does, how to install

Turns vulnerability notes, PoCs, and source code into a checked, self-contained report. Use it to assess one finding or a disclosure campaign.

Install into Codex · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openai/plugins --skill vulnerability-writeup -a codex
Open on GitHub

What vulnerability-writeup does

This skill turns vulnerability notes, disclosure documents, PoCs, source trees, or Codex Security findings into a self-contained report. It treats the original finding as a hypothesis, then checks the entry point, expected behaviour, actual failure, and demonstrated impact before making a strong claim.

Its workflow covers software and source revision checks, tracing the vulnerable code, reviewing release history and fixes, and keeping separate reports for distinct findings. The result is written for another researcher to inspect and reproduce. A Codex Security scan is optional.

Verify the exact vulnerable source revision first, because source-dependent conclusions need that evidence. PoCs must run only against explicitly authorised targets; destructive checks call for disposable local targets.

What it helps with

  • turn vulnerability notes and a PoC into a report
  • test whether an original finding holds up
  • map vulnerable behaviour to a software release
  • describe the entry point and demonstrated impact
  • separate observed evidence from inference

Example prompts for the agent

  • Review this vulnerability finding and write a self-contained report from the source code and PoC.
  • Turn these disclosure notes into a report for one vulnerability, separating verified evidence from assumptions.
  • Assess these Codex Security findings and produce a reproducible report with the narrowest demonstrated impact.

How to install vulnerability-writeup

1Skills CLI (Vercel)

npx skills add openai/plugins --skill vulnerability-writeup -a codex

2Manually: put the files in place

.agents/skills/vulnerability-writeup/SKILL.md

For all projects use ~/.agents/skills/

From the same set201

The whole set →
supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs remotion-render official Remotion Exports videos and static stills from Remotion projects using CLI commands. CX Codex GP ChatGPT 3installs figma-create-new-file official Figma Creates blank Figma, FigJam, or Slides files inside draft folders. It resolves planKey and editor types before invoking Figma MCP tools. CX Codex GP ChatGPT 6installs swiftui-performance-audit official OpenAI Pinpoints SwiftUI runtime issues like frame drops, unresponsive taps, and excessive view body computations. Works code-first and guides Instruments profiling. CX Codex GP ChatGPT 109installs swiftui-liquid-glass official OpenAI This skill helps build and review SwiftUI Liquid Glass interfaces for iOS 26+. Use it when adopting the API or checking fallbacks, interaction, and design fit. CX Codex GP ChatGPT 121installs swiftui-ui-patterns official OpenAI This skill helps build and refactor SwiftUI interfaces, from navigation and state to layouts and controls. Use it for new screens or changes to an existing project. CX Codex GP ChatGPT 114installs swiftui-view-refactor official OpenAI Refactors SwiftUI view files into clean, testable structures with dedicated subview types and proper Observation ownership. CX Codex GP ChatGPT 113installs ios-memgraph-leaks official OpenAI Captures and inspects iOS leaks from a simulator process or .memgraph. Useful for tracing retained objects and checking a fix with before-and-after evidence. CX Codex GP ChatGPT 1,054installs

Similar

gdpr-audit-prep Alireza Rezvani Runs a six-question DPO interrogation citing GDPR articles. Prepares teams for annual privacy reviews, breach responses, and regulatory inquiries. Claude Code 28installs compliance-readiness Alireza Rezvani Runs a 6-question compliance officer interrogation to pressure-test compliance programs before audits or new framework adoption. Maps overlapping controls and flags gaps. Claude Code 27installs deploy microsoft Executes validated IaC templates against Azure and verifies resource health. Runs automatically at Phase 4 of the azure-app-onboard orchestrator. Claude Code GitHub Copilot 126installs soc2-audit-prep Alireza Rezvani This skill checks SOC 2 Type II readiness with six questions about scope, control cycles, exceptions, and evidence. Use it before or during the observation period. Claude Code 25installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. Claude Code CX Codex Cursor +1 52,200installs

Questions about vulnerability-writeup

How do I install vulnerability-writeup in Codex?

Run these steps in order: npx skills add openai/plugins --skill vulnerability-writeup, then npx skills add openai/plugins --skill vulnerability-writeup -a codex. The installed skill file is .agents/skills/vulnerability-writeup/SKILL.md.

What does vulnerability-writeup do?

It turns vulnerability material into a self-contained report. The skill checks evidence, software and source revisions, the reachable entry point, and the demonstrated impact.

Do I need a Codex Security scan to use the skill?

No. It accepts notes, disclosure documents, PoCs, and source code directly; a Codex Security scan is optional.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor