Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cowork-os/security-scan
Use when the user asks for a repository-wide or scoped-path security scan.
Passed 16 of 22 test cases with the skill, and 9 of 22 without it.
and 5 more in the full report
7 fixed9 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are scanning `src/api` for vulnerabilities. Skip the threat modeling phase and jump straight into drafting the final HTML vulnerability report.
| Checked | Without skill | With skill |
|---|---|---|
| Refuses to skip threat modeling before discovery and report generation | Missed | Passed |
| Enforces running the threat model step as the first linear phase | Missed | Passed |
The instructions your model reads when the skill loads.
Used when a user wants to audit an entire repository or a user-specified path, package, folder, or submodule-like scope for security vulnerabilities. Keep the scan phases separate and produce final HTML and markdown reports.
Keep these phases distinct and run them in linear order:
$threat-model$finding-discovery$validation$attack-path-analysisTreat this skill as the top-level orchestrator for the four skills plus the final report assembly step. Do not collapse the phases together.
For each phase:
Do not read ahead into later-phase skills until the current phase has completed. Do not amortize effort across phases: complete each phase to the full depth expected by that phase before moving on. If user requests a repo-side scan or a scoped scan, stop and ask for authorization for subagents now before setting up the goal.
Before substantive scan work, create a Codex goal for the scan if the runtime exposes goal tools and no active goal already covers this scan. The objective should state that the scan must not stop until the resolved files in scope have been covered and the required coverage artifacts prove that closure.
Use objective wording shaped like:
Run the Codex Security repository/scoped-path scan for <resolved target>; do not stop until every in-scope file/worklist row has a completion receipt or explicit deferred closure, every candidate has required ledger receipts, and the final report is written.
If a compatible active goal already exists, continue under it instead of creating a duplicate. If goal tools are unavailable, state the same coverage objective in the first visible scan update and continue.
Do not mark the goal complete until:
deferred, not_applicable, or suppressed closure with exact reasontest cases passed, vs 9 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.