Security Review Skill

Trigger

• Keywords: security review, OWASP, vulnerability, dep-audit, npm audit, dependency security

When NOT to Use

• General code review (use codex-code-review)
• Functional testing (use test-review)
• Performance issues (not security-related)

Commands

Command	Purpose	When
/codex-security	OWASP Top 10 audit	Security-sensitive code
/dep-audit	Dependency security audit	Periodic / PR

Workflow: /codex-security

Determine scope → Collect changes → Codex OWASP review → Findings + Gate → Loop if Must fix

Step 1: Determine Scope

Parse --scope from arguments, default to src/.

Step 2: Collect Change Metadata

Metadata, not content: the first dispatch carries the changed-file list and diff stats, and Codex reads the diffs itself from the sandbox (@rules/codex-invocation.md § Required in every first-dispatch prompt). A truncated | head -1500 excerpt was the old shape, and it decided for the reviewer which 1500 lines of a security review mattered.

1. CHANGED_FILES: git diff --name-only HEAD -- <scope> ∪ git ls-files --others --exclude-standard -- <scope>
2. DIFF_STAT: git diff --stat HEAD -- <scope>
3. SCOPE: the resolved scope argument, plus the security-relevant paths a Glob("**/*{auth,login,password,token,secret,key,credential}*") surfaces — named as places to look, never pasted

Step 3: Codex Security Review

First review: dispatch per @skills/codex-code-review/references/codex-transport.md § Start with the OWASP prompt. See references/codex-prompt-security.md.

Save the returned threadId.

Loop review: dispatch per @skills/codex-code-review/references/codex-transport.md § Resume with the re-review template. See references/codex-prompt-security.md.

Step 4: Consolidate Output

Organize results into findings summary table + detailed findings + gate.

OWASP Top 10:2025

The version is part of the identifier: SSRF is no longer A10 (it sits inside A01), and A02–A06 renumbered, so a finding labelled with a 2021 code says something different to whoever reads it.

Code	Category	Check Focus
A01	Broken Access Ctrl	IDOR, permission bypass, CORS, SSRF
A02	Misconfiguration	Debug mode, default passwords
A03	Supply Chain Failures	Vulnerable deps, unverified build sources
A04	Crypto Failures	Sensitive data encryption, weak crypto
A05	Injection	SQL/NoSQL/Cmd Injection, XSS
A06	Insecure Design	Rate Limiting, business logic
A07	Auth Failures	Brute force, session, weak passwords
A08	Integrity Failures	Deserialization, CI/CD
A09	Logging & Alerting	Sensitive data in logs, auditing, alerts
A10	Exceptional Conditions	Error paths that fail open or leak

Review Loop

⚠️ @CLAUDE.md auto-loop: fix → re-review → ... → ✅ PASS ⚠️

⛔ Must fix → fix P0 issues → /codex-security --continue <threadId> → repeat until ✅ Mergeable.

Max 3 rounds. Still failing → report blocker.

Verification

• Each issue tagged with severity (P0/P1/P2)
• Gate is explicit (✅ Mergeable / ⛔ Must fix)
• Fix recommendations are specific and actionable
• Includes verification test method
• Codex independently researched auth/input/sensitive code

References

• OWASP prompt: references/codex-prompt-security.md
• Examples: references/examples.md
• Standards: @rules/security.md

Examples

Input: /codex-security --scope src/controller/
Action: OWASP Top 10 check → output issues + Gate

Input: /dep-audit --level high
Action: npm audit → filter high/critical → output report