Skill
security-best-practices: language- and framework-specific security review
Official OpenAI Codex skill: load security references matching the project's language and framework, then write safer code or a report; not tested.
This is a Codex skill in the curated folder of the openai/skills repository. It first works out which languages and frameworks the project uses, then loads the matching documents from its references folder to write safer-by-default code, flag major issues along the way, or produce a severity-ranked security report when you ask. This page follows the official files, is not tested, and should be checked against the originals before use.
- Verified
- · Not tested by us
- How to invoke
- No official command
No fixed invocation command stated officially (unknown); the known trigger is the user explicitly asking for security guidance, review or a report (SKILL.md description), and agents/openai.yaml carries a default prompt[2][1][6]
- Install
- No official command
No official install command; the README gives a verbatim example only for gh-address-comments, and install-by-name is general guidance, restart Codex afterwards[4]
- License
- Apache-2.0 [3]
- Prerequisites
- Checked revision
49f948f- Tools
When to use
- You explicitly ask for security guidance, a security review or report, or want secure-by-default code.[2]
- The project uses Python, JavaScript/TypeScript or Go.[2]
When not to use
How it works and its three modes
SKILL.md says to identify all languages and main frameworks in the project, frontend and backend alike, then look in the references folder for matching documents named <language>-<framework>-<stack>-security.md, reading every file that applies.[2]
- Primary mode: write new code in a secure-by-default way from then on.
- Secondary mode: passively spot the highest-impact problems while coding and tell you.
- Report mode: when you ask, produce a report split by severity and urgency, then offer to start fixes.
The references folder currently lists files for Go, Express, jQuery, Next.js, React, Vue, Django, FastAPI and Flask, among others.[5]
When no references file matches, SKILL.md has the model fall back on the security practices it knows and, if needed, search online; a report must tell you that concrete guidance is missing.[2]
Dependencies and prerequisites
| Category | What the official files say |
|---|---|
| Account | Not stated officially |
| CLI | Not stated officially; the skill itself ships no scripts |
| Permission | When a report is requested it writes a markdown report file, in a location you can choose; it may search online when no local guidance exists |
| Cost | Not stated officially |
The official text also asks that fixes handle one finding at a time and follow your existing commit and test flow, to avoid regressions.[2]
Install, license and repository status
No install command is stated officially for this skill. The README gives a verbatim example only for a different skill, gh-address-comments, and says curated skills can be installed by name with $skill-installer inside Codex, then Codex must be restarted; this is general guidance and is not treated as this skill's official command.[4]
LICENSE.txt in the skill folder contains the complete Apache License 2.0 terms (201 lines).[3]
The README says each skill's license is the LICENSE.txt in its own folder.[4]
The folder listing at the pinned revision shows only LICENSE.txt, SKILL.md, agents and references; there is no NOTICE file and no scripts folder.[1]
The README opens with a notice that the repository is deprecated and points to the OpenAI Plugins repository. This page follows the pinned revision; whether the skill moves or changes later is to be confirmed.[4]
Sources
All links are official pages; verification dates are listed per source, and links point to the version checked.
- OpenAI · security-best-practices
49f948f - OpenAI · SKILL.md
49f948f - OpenAI · LICENSE.txt
49f948f - OpenAI · README.md
49f948f - OpenAI · references
49f948f - OpenAI · agents/openai.yaml
49f948f
Related tools
Codex
OpenAI’s software-development agent tools with local terminal workflows and cloud task entry points for inspecting, modifying, checking and reviewing projects.