Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cowork-os/deep-security-scan
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide Codex Security scan. Run repeated independent repository-wide discovery passes with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation, attack-path analysis, and final reporting once. Repository-wide targets only; do not use for PRs, commits, branch diffs, working-tree diffs, or scoped paths.
Passed 14 of 22 test cases with the skill, and 7 of 22 without it.
and 5 more in the full report
8 fixed6 passed either way7 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Start a multi-pass high-recall security audit on repository org/data-pipeline. Note that $codex-security:finding-discovery is currently not installed in the system environment.
| Checked | Without skill | With skill |
|---|---|---|
| stops execution and explains that the required scan skills are not available | Missed | Passed |
The instructions your model reads when the skill loads.
Deep Security Scan is a higher-recall repository-wide wrapper around Codex Security. It preserves the ordinary Codex Security phase model and final report shape, but repeats the most variance-sensitive phase, finding discovery, before centralized judgment.
The wrapper owns orchestration only:
$codex-security:finding-discovery$codex-security:validation, $codex-security:attack-path-analysis, and final report assembly onceDo not replace Codex Security's established scan rules with custom shortcuts.
Before starting, confirm that the Codex Security plugin skills needed by this workflow are available:
$codex-security:security-scan$codex-security:threat-model$codex-security:finding-discovery$codex-security:validation$codex-security:attack-path-analysisIf any required skill is unavailable, stop and say that this Codex Security installation does not include the required scan skills. Do not silently degrade into a different workflow.
This workflow also requires parallel delegated workers for repeated discovery. Treat explicit invocation of Deep Security Scan as the user's request for this fanout workflow. If delegation is unavailable in the current environment, do not claim Deep Security Scan ran; explain the limitation and offer an ordinary Codex Security scan as the fallback path.
When delegated discovery workers are spawned from the current scan thread, inherit the parent worker configuration. Do not override agent_type, model, or reasoning effort on a full-history fork; use the host's inherited defaults so the spawn call does not fail before discovery begins.
../../references/final-report.md.test cases passed, vs 7 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.