skills.rest
openai
openaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

define-security-policy

Define and update SECURITY.md guidance for repository security scanning.

5.3k|765|Updated Mar 4, 2026
Search Tags:#security policy#code scanning#policy review#threat model#repository security#SECURITY.md
One-click install
npx skills add https://github.com/openai/plugins --skill define-security-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: define-security-policy
Source: https://github.com/openai/plugins/tree/main/plugins/codex-security/skills/define-security-policy
Command: npx skills add https://github.com/openai/plugins --skill define-security-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Repositories often lack clear security policy guidance, leaving security scanners without context about system boundaries, threat models, and what counts as a reportable finding. This Skill helps you define, review, and update SECURITY.md files so Codex Security reviews the right scope with the right severity context.

Core Features & Use Cases

  • Policy Discovery and Resolution: Inventories existing SECURITY.md files across a repository, including nested component policies, and resolves the applicable policy chain from root to leaf.
  • Security Boundary Analysis: Reads source, configuration, tests, and prior findings to establish the system scope, threat model, security invariants, and exclusions that a policy should capture.
  • Drafting and Review Workflow: Produces a structured policy draft, shows the exact proposed diff, and requires explicit approval before writing changes.
  • Use Case: A team adopting Codex Security on a multi-component repository uses this Skill to create a root SECURITY.md defining tenant isolation invariants and out-of-scope finding classes, so scans produce relevant, actionable results.

Quick Start

Ask the assistant to define or update this repository's SECURITY.md and show the proposed diff before applying it.

Frequently Asked Questions about define-security-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a SECURITY.md for my repository?▼

A useful SECURITY.md covers system and scope, threat model and trust boundaries, security invariants, reportable findings with severity context, and out-of-scope exclusions. This Skill drafts that structure from evidence in your source, tests, and configuration, then shows a diff for approval.

How do nested SECURITY.md files work in a monorepo?▼

Root and nested policies compose from root to leaf, and the policy closest to the code takes precedence when guidance conflicts. The resolver script inventories all policy paths and resolves the applicable chain for a given file or directory scope.

Does the policy resolver work on Windows and macOS?▼

Yes, the resolve_security_md.py script runs on Windows, macOS, and Linux. It emits a sorted JSON array of repository-relative policy paths and enforces a 1 MiB size limit on regular files and repository-local symbolic links.

What should be excluded from a security policy file?▼

Keep secrets, sensitive finding details, and unnecessary exploit detail out of repository policy. Exclusions and accepted risks must be confirmed by the owner, and broad exclusions that could hide real findings should be flagged during review.

Can the Skill edit .github/SECURITY.md or docs/SECURITY.md?▼

No, those files are not treated as repository-wide scanner guidance and are not overwritten when creating a root policy. New guidance goes to the repository root SECURITY.md or a component-level SECURITY.md after user confirmation.

Related Skills

Explore More Software Engineering Skills→
vishalkhondrevishalkhondre

04-containers

Identify deployable containers and map their interconnections for C4 diagrams.

Community
Intermediate
NUMU-IONUMU-IO
2

speckit-security-review-followup

Convert security review findings into backlog-ready remediation and technical debt plans.

Official
Intermediate
davila7davila7
30.5k

senior-security

Automate threat modeling, security auditing, and penetration testing workflows with Python scripts.

Community
Intermediate
ArdurAIArdurAI
1

god-iam-gcp

Manage and audit IAM resources, policies, and configurations in Google Cloud Platform.

Official
Advanced