codex-security-audit-skill

Run a structured security audit covering secrets, authentication, authorization, input validation, CORS, uploads, payments, and dependencies. This Skill inspects your repository, classifies findings by severity with file-and-line evidence, and outputs a prioritized fix plan.

Use the included scan_secrets.py script with python3 against your project path. It detects AWS keys, GitHub tokens, OpenAI and Stripe keys, private keys, and assigned secrets, printing redacted matches with file paths and line numbers as leads for manual review.

The security-checks.md reference covers repository hygiene, authentication and sessions, multi-tenant authorization, injection, file uploads, CORS and headers, rate limits, payment webhook verification, dependency hygiene, logging privacy, and mobile client risks.

Yes. When asked, it patches Critical and High issues with the smallest necessary surface, preserves existing architecture, adds validation and authorization checks near boundaries, and adds regression tests for auth, injection, upload, and webhook paths.

No. The scanner output is only a first pass and matches should be treated as leads needing code review. The audit rules require separating confirmed issues from suspicious patterns and never printing full secrets.

It avoids claiming current CVEs unless verified with an actual audit command, does not provide legal or compliance conclusions, and focuses on concrete exploitable risks rather than generic checklists. Findings require plausible code paths as evidence.