Testing & Security skills

Adds an explicit permission step before an agent deletes files or directories. It covers shell commands and deletion scripts, groups multiple files into one request, and requires the agent to stop when permission is denied.

• Confirming permission before deleting files
• Reviewing multiple deletions in one request
• Adding approval steps to cleanup scripts

Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.

• Reviewing code for security vulnerabilities
• Checking dependencies and exposed credentials
• Auditing cloud and infrastructure security

Create unit, integration, and E2E tests that check complete user flows, then identify coverage gaps and investigate unreliable results. The skill also supports performance and security test plans, with findings organized by severity and suggested fixes.

• Writing tests for normal behavior, errors, and boundary values
• Finding gaps in test coverage
• Investigating tests that fail intermittently

Implement application security controls, including login, access permissions, password hashing, and input validation. The skill provides code, configuration requirements, and testing guidance for checking protections against unauthorized access, malicious input, and sensitive data exposure.

• Implementing login with password hashing and rate limits
• Adding JWT validation and session protection
• Preventing SQL injection and malicious script execution

Create Playwright tests that check user journeys in a browser. The skill organizes reusable page interactions, configures test environments, investigates intermittent failures using execution traces, and supports API mocking, visual comparisons, and automated pipeline integration.

• Test login and other browser user journeys
• Investigate tests that fail intermittently
• Replace API responses with controlled test data

Design controlled failure experiments for distributed systems to examine how services recover. Produce failure injection scripts, monitoring plans, rollback procedures, and exercise guides, then turn findings into documented improvements.

• Planning controlled failure experiments
• Testing recovery after Kubernetes Pod failures
• Checking service behavior under network delays

Investigate errors, crashes, and unexpected behavior by reproducing failures, tracing execution, and comparing logs. Tests one explanation at a time, then provides a verified fix, supporting evidence, and tests or safeguards to prevent recurrence.

• Investigate error messages and execution traces
• Find the cause of an application crash
• Compare logs to locate a failure

Independently checks code changes against the original issue, runs tests, and verifies that edits stay within scope. Produces an approval, rejection, or request for human judgment, supported by test results and specific findings.

• Independently reviewing another agent's implementation
• Checking that a CI failure was actually fixed
• Finding unrelated edits or disabled tests

Review dependency files to find outdated packages and security vulnerabilities. Sort updates by severity and version change, identify cases needing human review, and record a prioritized update list with testing requirements.

• Prioritizing outdated dependencies
• Separating security fixes by severity
• Identifying major updates needing human review

Review dependency manifests and lockfiles to find outdated packages and known security vulnerabilities. Group proposed updates by version change, report current and suggested versions, and identify updates that need human review.

• Reviewing outdated dependencies
• Checking known vulnerabilities and update options
• Separating patch, minor, and major updates

Validate workflows and reproduce issues in an embedded browser. Distinguish application problems from incorrect targets, missing waits, or session state, then report the shortest reliable reproduction steps with only the evidence needed to support the finding.

• Reproducing a browser workflow failure
• Checking for regressions after a fix
• Distinguishing timing issues from application failures

Import security findings from Snyk Open Source, Semgrep Code, Endor Labs, GitHub, or Wiz into local storage or Codex Security Cloud, with a preview of the destination, supporting evidence, and excluded records.

• Import existing security reports into local storage
• Review evidence before publishing findings to Cloud
• Import selected GitHub alerts or GHSA advisories

Read existing findings, reports, recorded assignments, verification results, and scan status from a connected Codex Security Cloud account. Summarize available evidence and distinguish missing information from confirmed outcomes without changing Cloud data.

• Inspect a finding from its Cloud link
• List findings by severity or recorded assignee
• Review saved validation and patch check reports

Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.

• Turning vulnerability notes into a disclosure report
• Checking source code and proof-of-concept claims
• Preparing separate reports for multiple vulnerabilities

Run repeated, independent security reviews of an entire repository or a selected directory. The skill combines validated findings and coverage records into a final report, helping reduce variation between individual reviews.

• Reviewing an entire repository through repeated security audits
• Running an intensive review of a selected directory
• Combining validated findings and coverage into one report

Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.

• Find structural causes shared by several vulnerabilities
• Compare security architecture options and costs
• Explain proposed changes with before-and-after diagrams

Create or review SECURITY.md guidance so Codex Security understands what to examine, which protections must hold, and what is excluded. Compare existing policies with repository evidence and preview proposed changes before writing.

• Define security review scope for a repository
• Document required security protections
• Check whether existing guidance matches the code

Turn validated Codex Security findings into tracked work in Linear, Jira, GitHub issues, or draft GitHub security advisories. Check for duplicates, preview exact content and audience, and record approved creations, updates, or reuse.

• Create issues from validated security findings
• Find and reuse existing issues for the same finding
• Register a reviewed batch of security issues

Create, update, or reuse a repository threat model: a document describing its architecture, attacker capabilities, trust boundaries, and potential security failures. The result is a Markdown reference grounded in the repository's actual code and scope.

• Documenting architecture and trust boundaries
• Creating or updating a repository threat model
• Preparing a threat model for a specific security review

Assess candidate security findings using focused reproduction, tests, or code tracing. Record the evidence, confidence, and remaining proof gaps for each candidate, helping determine which findings warrant reporting and which remain uncertain.

• Verify whether a suspected vulnerability can be reproduced
• Reassess a finding previously marked as a false positive
• Trace vulnerable paths when runtime services are unavailable

Audit an entire repository or a selected folder, package, or path in one review pass. Produce a security report with source evidence, severity assessments, and clear coverage limits, including unresolved questions that need further investigation.

• Run a standard security audit of a repository
• Review a selected folder or package
• Check findings alongside evidence and coverage gaps

Evaluate supplied security findings against repository code and security policy without running the software. Classify each claim as confirmed, not actionable, or needing review, then rank relevant findings by exploitability and explain evidence gaps and next steps.

• Assess findings from a vulnerability scanner
• Review security tickets from Jira or Linear
• Evaluate GitHub alerts and security advisories

Review pull requests, commits, branch differences, or local patches for security vulnerabilities. Inspect changed and deleted text files, trace relevant supporting code, and return validated findings, review comments, and a report describing coverage gaps.

• Review a pull request for security vulnerabilities
• Check a commit or branch diff before merging
• Inspect local changes, including deleted files

Fix a validated or plausible security vulnerability with a focused code change, then verify that the attack no longer works and legitimate behavior remains intact. Report when existing code is safe or essential evidence is missing.

• Fix a reported vulnerability and verify the result
• Check for alternate inputs that bypass a proposed fix
• Confirm that a security patch preserves legitimate behavior