Test design, vulnerability assessment, and quality assurance (13K skills)
Evaluate local Codex skills and plugins, understand their scores, and identify fixes to prioritize. Get explanations of token estimates, set up benchmark scenarios, and prepare workflows for measuring actual token usage.
Compares a prototype’s rendered screens with its source design to find differences in typography, spacing, colors, images, and text. Produces prioritized fixes and records visual evidence from follow-up checks before handoff.
Add team-specific evaluation criteria to plugin-eval by designing a metric pack, a set of custom checks and measurements. Create its manifest and JSON-producing script, then run it through the evaluator using a consistent output structure.
Evaluate a local Codex plugin to understand its scores and identify what to fix first. Review stronger and weaker skills, prepare benchmark runs, compare saved results across versions, and produce a readable report.
Test browser games through player actions and screenshot review. It checks startup, controls, scene changes, and interface visibility, then reports concrete issues with severity, reproduction steps, and the likely responsible subsystem.
Verify whether a reported vulnerability is fixed in the current code without changing repository files. Trace the original attack path, examine possible bypasses and legitimate behavior, and return an evidence-based verdict for each supplied finding.
Assess candidate security findings using focused reproduction, tests, or code tracing. Record the evidence, confidence, and remaining proof gaps for each candidate, helping determine which findings warrant reporting and which remain uncertain.
Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.
Examines code or code changes for plausible security vulnerabilities by tracing attacker-controlled input to dangerous operations or failed safeguards. Records candidate issues with affected locations, supporting evidence, potential impact, and controls that need further validation.
Review pull requests, commits, or local changes for security vulnerabilities, including deleted files. Validate potential issues, trace how attacks could reach them, and produce a report showing confirmed findings and gaps in review coverage.
Design tests for charts, dashboards, and interactive diagrams. Combine data checks, component tests, screenshot comparisons, and end-to-end workflows to catch incorrect values, broken interactions, and visual changes while keeping tests stable.
Assess a fixed code patch for behavior changes, regression risks, test coverage, and recovery options. Receive an evidence-based report and structured assessment indicating whether it is ready to merge and qualifies as an automatic merge candidate.
Audit a repository or selected source paths for security issues in a single pass. Produce a report with source evidence, severity, possible attack paths, validation results, and an honest account of what was reviewed.
Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.
Run repeated, independent security audits of a repository or selected directory with Codex Security. It combines validated findings into a report that records the reviewed scope, exclusions, and any incomplete coverage.
Create, update, or reuse a repository threat model: a document describing system architecture, attacker capabilities, trust boundaries, and potential security failures. Produce a Markdown model grounded in source evidence for standalone use or a security scan.
Turn validated Codex Security findings into tracked issues in Linear, Jira, or GitHub, or draft GitHub security advisories. Checks duplicates and visibility, previews exact changes for approval, and verifies results after writing.
Create or review SECURITY.md guidance so Codex Security understands what to examine, which protections must hold, and what is excluded. Compare existing policies with repository evidence and preview proposed changes before writing.
Trace a security finding from an attacker’s entry point to its impact using repository evidence. Examine access, permissions, existing defenses, and counterevidence to assess severity and decide whether the finding warrants reporting.
Fix a validated or plausible security vulnerability with a focused code change, then verify that the attack no longer works and legitimate behavior remains intact. Report when existing code is safe or essential evidence is missing.
Audit page loading speed with Chrome DevTools MCP, a tool connection for browser inspection. Measure performance indicators, investigate network delays and layout shifts, check accessibility gaps, and produce prioritized fixes with estimated impact and relevant code findings.
Evaluate supplied security findings against repository code and security policy without running the software. Classify each claim as confirmed, not actionable, or needing review, then rank relevant findings by exploitability and explain evidence gaps and next steps.
Investigate failing macOS tests in Xcode or SwiftPM by running a focused test scope, classifying errors, and separating setup issues from code regressions. Get a concise explanation of likely causes and the next verification step.
Capture and analyze iOS memory snapshots to find objects that remain allocated unexpectedly. Trace the references keeping them alive, identify a targeted fix, and compare the same app flow before and after to document evidence.