COMPLETE PLUGIN
View an example
Example installation for Review
Example session using the verified commands above.
Run deterministic code security and quality scans — secret detection, debug artifact cleanup, and TODO/FIXME tracking. Use this skill before any security review, code audit, PR review, or when the user says 'scan for secrets', 'find debug logs', 'check for TODOs', 'audit this code', 'security scan', or 'clean up before shipping'. Also use proactively before deployments or when reviewing unfamiliar codebases. Runs all scans in parallel for speed.

Install the complete plugin to include its agents, hooks, commands, and runtime context.
Fastest path: hand this line to the coding agent doing the setup. It reads this page and installs the Review plugin, which ships this skill with everything it relies on.
Click anywhere on the prompt to copy.
Choose a runtime, then follow its setup steps. This installs the complete Review plugin.
COMPLETE PLUGIN
Example session using the verified commands above.
The portable SKILL.md on its own, without the plugin’s hooks, agents, commands, and companion skills. Use it only when you intentionally want the narrower path.
No required companion skills are declared.
Pass the canonical page to a teammate or keep it close for later.
Run OpenAI's agentic security scanner (`@openai/codex-security`) over a repo, PR, or diff, then triage, patch, and gate on its findings. Use for 'run a codex security scan', 'find vulnerabilities in this PR', 'export findings as SARIF', 'fix that security finding', 'compare this scan to the last one', or when a pattern sweep came back thin. Not for dependency CVEs, secrets, or licenses (code-audit-scripts, bun audit).