Publisher: OpenAI · Editorial profile by AI Tools Ratings · Review method
Not runtime tested; source-document review only. No security certification.
What task is this skill designed for?
Review a small web API’s authentication, input handling and sensitive-data exposure, then propose changes tied to code locations.
What input and output should you expect?
Input: An in-scope repository path, its runtime frameworks, deployment assumptions and the requested review depth. Supply test configuration without live secrets.
Output: Expected, not independently tested: findings with file context, impact and remediation suggestions, with assumptions separated from demonstrated issues.
What does it need to run?
Repository-reading capability and the reference files relevant to the actual supported language and framework. Running tests or applying fixes requires a suitable project runtime and explicit task scope.
Authored for Codex in the OpenAI skills repository. This directory has not independently installed or executed the skill.
How should you approach installation?
- Read the pinned scope and the framework references that match your project.
- Start with a small source-only review and remove credentials from supplied context.
- Triage the report before authorizing fixes; use separate tooling for dependency and runtime coverage.
Installation guide: discovery, dependencies and runtime checks
What files, accounts or data can it access?
Reads application source and configuration. Approved remediation can modify code. Avoid including production secrets in reports, and do not turn a source review into unrequested exploitation of external systems.
What does the skill cost?
No skill purchase is listed. Agent runtime and any separate scanners or testing services may have costs.
What are its limits and alternatives?
The pinned description limits the intended languages to Python, JavaScript/TypeScript and Go. This is guidance-driven source review, not a penetration test, certification or proof that all vulnerabilities were found.
Use a dependency scanner for known vulnerable package versions and a dedicated assessment for runtime attack validation. Choose this skill when framework-specific coding decisions need explanation and code-context recommendations.
What could you ask in a small trial?
Try this with a small sample:
Review only the API directory for Python security best practices. Separate confirmed code issues from deployment assumptions, cite file locations and propose fixes without changing production or probing external hosts.
How would you verify the result?
- Verify each finding against the actual data flow and framework behavior.
- Reproduce an applicable issue safely in a test environment before calling it confirmed.
- After a fix, check both the security condition and the legitimate user flow.
Use a baseline and record acceptance evidence before treating a successful task as a reliable workflow.
Which source and license were checked?
Read the reviewed SKILL.md at its pinned commit · Complete reviewed folder
Repository and current publisher guidance
Checked:
Apache-2.0 — identified in skills/.curated/security-best-practices/LICENSE.txt at the reviewed commit. Third-party assets and dependencies may have separate terms. License evidence
Version details and review scope
Source: openai/skills/skills/.curated/security-best-practices
Reviewed commit: 49f948faa9258a0c61caceaf225e179651397431
SKILL.md SHA-256: 7b3dae1ffc5434d890f3c65c8f552af52d0307fab3b35dec13013c9ca3844c4f
Source-document review. Source text and stated dependencies were inspected for this profile. Referenced code was not comprehensively audited, no runtime test was performed, and source files are not mirrored here.