Run OpenAI's agentic security scanner (`@openai/codex-security`) over a repo, PR, or diff, then triage, patch, and gate on its findings. Use for 'run a codex security scan', 'find vulnerabilities in this PR', 'export findings as SARIF', 'fix that security finding', 'compare this scan to the last one', or when a pattern sweep came back thin. Not for dependency CVEs, secrets, or licenses (code-audit-scripts, bun audit).
Install the complete plugin to include its agents, hooks, commands, and runtime context.
Fastest path: hand this line to the coding agent doing the setup. It reads this page and installs the Review plugin, which ships this skill with everything it relies on.
Click anywhere on the prompt to copy.
Choose a runtime, then follow its setup steps. This installs the complete Review plugin.
COMPLETE PLUGIN
Example session using the verified commands above.
The portable SKILL.md on its own, without the plugin’s hooks, agents, commands, and companion skills. Use it only when you intentionally want the narrower path.
No required companion skills are declared.
Code-level security auditor. Use this agent when the user asks to "audit this code for security issues", "review this PR for vulnerabilities", "check for injection risks", or "run a security review before merge", or asks whether a Vercel Security Dashboard finding reflects a code or configuration defect. Produces a severity-rated report with specific fixes using git diff review, Semgrep, CodeQL, and Trail of Bits patterns. Not for dashboard posture sweeps, runtime dependency/secrets scanning (use security-ops), or architecture tradeoffs (use architecture-reviewer).
Operational and runtime security agent. Use this agent when the user asks to "scan our dependencies for CVEs", "check for leaked secrets", "is this OWASP compliant", "audit our Vercel security posture", or "run a supply chain audit". Covers Vercel Security Dashboard triage, incident response, and SOC 2 technical control validation. Not for code-level audits (use code-auditor) or architectural review (use architecture-reviewer).
Pass the canonical page to a teammate or keep it close for later.