security-scan
Scan your OpenAI Codex configuration (.codex/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CODEX.md, settings.json, MCP servers, hooks, and agent definitions.
npx skills add mturac/everything-openai-codex --skill security-scan --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Scan Skill Audit your OpenAI Codex configuration for security issues using [AgentShield](https://github.com/mehmet-turac/agentshield). ## When to Activate - Setting up a new OpenAI Codex project - After modifying `.codex/settings.json`, `CODEX.md`, or MCP configs - Before committing configuration changes - When onboarding to a new repository with existing OpenAI Codex configs - Periodic security hygiene checks ## What It Scans | File | Checks | |------|--------| | `CODEX.md` | Hardcoded secrets, auto-run instructions, prompt injection patterns | | `settings.json` | Overly permissive allow lists, missing deny lists, dangerous bypass flags | | `mcp.json` | Risky MCP servers, hardcoded env secrets, npx supply chain risks | | `hooks/` | Command injection via interpolation, data exfiltration, silent error suppression | | `agents/*.md` | Unrestricted tool access, prompt injection surface, missing model specs | ## Prerequisites AgentShield must be installed. Check and install if needed: ```bash # Check if installed npx ecc-agentshield --version # Install globally (recommended) npm install -g ecc-agentshield # Or run directly via npx (no install needed) npx ecc-agentshield scan
- When to Activate
- What It Scans
- Prerequisites
- Usage
- Basic Scan
- Output Formats
- Auto-Fix
- Deep 4.6 Deep Analysis
- Initialize Secure Config
- GitHub Action
- Severity Levels
- Interpreting Results
- Critical Findings (fix immediately)
- High Findings (fix before production)
Check if installed npx ecc-agentshield --version Install globally (recommended) npm install -g ecc-agentshield Or run directly via npx (no install needed) npx ecc-agentshield scan . Scan current project npx ecc-agentshield scan Scan a specific path npx ecc-agentshield scan --path /path/to/.codex
What does the security-scan skill do?
Scan your OpenAI Codex configuration (.codex/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CODEX.md, settings.json, MCP servers, hooks, and agent definitions.
How do I install it?
Run `npx skills add mturac/everything-openai-codex --skill security-scan --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mturac/everything-openai-codex, a repository with 84 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.