skills.rest
openai
openaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

deep-security-scan

Runs repeated independent repository-wide security scans and aggregates validated findings into canonical artifacts.

5.3k|765|Updated Mar 4, 2026
Search Tags:#security scan#vulnerability detection#repository analysis#Threat Modeling#findings aggregation#codex security#multi-pass audit
One-click install
npx skills add https://github.com/openai/plugins --skill deep-security-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deep-security-scan
Source: https://github.com/openai/plugins/tree/main/plugins/codex-security/skills/deep-security-scan
Command: npx skills add https://github.com/openai/plugins --skill deep-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Single-pass security audits can miss vulnerabilities due to variance in analysis. This Skill runs multiple complete, independent Standard security scans against a repository or scoped path, aggregates their validated findings, and produces canonical scan artifacts and a sealed report for higher-confidence vulnerability detection.

Core Features & Use Cases

  • Multi-Pass Independent Scanning: Coordinates repeated complete Standard audits, each with its own threat map, investigation, source-backed validation, and attack-path reasoning.
  • Aggregated Canonical Artifacts: Produces a parent scan-manifest.json, findings.json, and coverage.json, then seals them and generates report.md via a single completion call.
  • Context and Concurrency Management: Supports user-provided security context, mid-scan context updates, native continuation via scanId, and a guard against concurrent deep scans.
  • Use Case: Before a major release, run a deep scan over the entire repository so multiple independent audit passes surface vulnerabilities that a single scan might miss, then review the aggregated report.

Quick Start

Ask the agent to run a deep Codex Security scan on the current repository and report the aggregated findings.

Frequently Asked Questions about deep-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a deep security scan on a repository?▼

Invoke the deep-security-scan skill with a target path and scope, which calls start_codex_security_deep_scan to launch repeated independent Standard scans. After the coordinator returns the manifest path, the scan is completed once to seal artifacts and generate report.md.

What is the difference between a deep scan and a standard security scan?▼

A deep scan runs multiple complete, independent Standard scans whose validated findings are aggregated into canonical parent artifacts, reducing variance. A standard scan is a single audit pass with one threat map, validation round, and report.

Can I use deep security scan for pull requests or branch diffs?▼

No. The skill explicitly does not support PRs, commits, branch diffs, or working-tree diffs. It is designed for repository-wide or scoped-path scans where the scoped directory is passed as the target path.

What happens if the deep scan tool is unavailable?▼

The workflow stops and explains that Deep Security Scan requires the Codex Security plugin server. It does not create a replacement scan, infer results, or fabricate findings when the coordinator tool cannot be invoked.

How long can a deep security scan run?▼

The coordinator dispatches workers until the configured deep_scan max_time_hours limit, with a default and maximum of 96 hours, leaving roughly one hour for finalization under the 97-hour tool-call timeout. Partial coverage is explicitly labeled in the final output.

Can I update the scan context while a deep scan is running?▼

Yes. User-supplied context changes are applied via update_codex_security_scan_context with the complete updated value and handoff claim token. Each worker keeps the immutable context captured when its independent scanning began.

Related Skills

Explore More Software Engineering Skills→
X-School-AcademyX-School-Academy
19

install-third-party-agent-skill-from-git

Install third-party agent skills from Git repositories via sparse checkout.

Official
Advanced
SocketDevSocketDev
125

scanning-vulns

Scan source files for static vulnerabilities and output VULN-FINDINGS.json and Markdown.

Official
Advanced
dapperdiversdapperdivers
1

report-generator

Generate structured markdown penetration test reports from JSON security scan findings.

Community
Intermediate
matthew-johnsonmatthew-johnson

requesting-code-review

Scan git diffs for security and quality issues before commits.

Community
Advanced