Find the best CLAUDE.md, AGENTS.md and Claude skills

OpenAISkill

word-list

openai/codex-security/evals/check-skills/fixtures/word-list/SKILL.md

Edit a paragraph using the current editorial glossary.

No other project uses it yet

OpenAISkill

assess-patch-risk

openai/codex-security/plugins/codex-security/skills/assess-patch-risk/SKILL.md

Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.

OpenAISkill

attack-path-analysis

openai/codex-security/plugins/codex-security/skills/attack-path-analysis/SKILL.md

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

check-skills

openai/codex-security/plugins/codex-security/skills/check-skills/SKILL.md

Review agent skills before installation or use. Use when a user or security team wants to check a skill file, bundle, or collection for unsafe instructions, scripts, permissions, or external dependencies.

OpenAISkill

cloud-findings

openai/codex-security/plugins/codex-security/skills/cloud-findings/SKILL.md

Read existing Codex Security Cloud findings, reports, recorded assignment and verification, and scan status from the connected account. Use for Cloud read requests and finding links, not local scans or requests to change Cloud data.

OpenAISkill

deep-security-scan

openai/codex-security/plugins/codex-security/skills/deep-security-scan/SKILL.md

Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit, branch or working tree, use security-diff-scan.

OpenAISkill

define-security-policy

openai/codex-security/plugins/codex-security/skills/define-security-policy/SKILL.md

Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.

OpenAISkill

finding-discovery

openai/codex-security/plugins/codex-security/skills/finding-discovery/SKILL.md

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

fix-finding

openai/codex-security/plugins/codex-security/skills/fix-finding/SKILL.md

Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.

OpenAISkill

propose-security-hardening

openai/codex-security/plugins/codex-security/skills/propose-security-hardening/SKILL.md

Develop evidence-backed structural security hardening proposals from disclosures, findings, source code, or Codex Security scans. Use for systemic improvements, alternatives beyond individual patches, architectural tradeoffs, or implementation planning. Also use when a top-level scan requests final-report hardening guidance.

OpenAISkill

publish-findings

openai/codex-security/plugins/codex-security/skills/publish-findings/SKILL.md

Import findings from scanners, CI reports, vendor CLIs, APIs, or connected tools into the local workbench. Publish a selection of stored vendor findings to Codex Security Cloud.

OpenAISkill

resolve-dependency-alert

openai/codex-security/plugins/codex-security/skills/resolve-dependency-alert/SKILL.md

Investigate a vulnerable dependency from a scanner alert, advisory, or SBOM match. Trace what pulls it in and determine whether it can be upgraded.

No other project uses it yet

OpenAISkill

security-diff-scan

openai/codex-security/plugins/codex-security/skills/security-diff-scan/SKILL.md

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

OpenAISkill

security-scan

openai/codex-security/plugins/codex-security/skills/security-scan/SKILL.md

Find vulnerabilities in the current source of a whole repository or selected paths. This is the default single-pass audit. Use the diff skill for PR, commit, branch, or working-tree changes and the deep skill for an explicitly requested deep scan.

Often used withdjango-security·deployment-patterns·postgres-patterns

OpenAISkill

threat-model

openai/codex-security/plugins/codex-security/skills/threat-model/SKILL.md

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Often used withvuln-scan·adr·prd

OpenAISkill

threat-model-visualize

openai/codex-security/plugins/codex-security/skills/threat-model-visualize/SKILL.md

Turn an existing threat model into an interactive architecture and threat-path explorer. Resolve simple requests for a target's last scan; do not perform a new assessment.

No other project uses it yet

OpenAISkill

track-findings

openai/codex-security/plugins/codex-security/skills/track-findings/SKILL.md

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.

OpenAISkill

triage-finding

openai/codex-security/plugins/codex-security/skills/triage-finding/SKILL.md

Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime validation, or fixes.

OpenAISkill

validation

openai/codex-security/plugins/codex-security/skills/validation/SKILL.md

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

verify-fix

openai/codex-security/plugins/codex-security/skills/verify-fix/SKILL.md

Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.