Security Best Practices Review
Security review and secure-by-default guidance for Python, JavaScript/TypeScript, and Go projects.
The skill clearly restricts triggering, supported languages, secret handling, disabling protections, and evidence-based findings. However, it permits online searching when references are missing, and its file-writing, fix workflow, external-data boundaries, and rollback expectations are not fully specified, so points are deducted.
SKILL.md, the agent metadata, and the supplied reference specs are broadly consistent and define workflows, decision logic, report structure, and abnormal cases. Still, key behavior depends on an unshown references directory and model knowledge fallback; static evidence cannot reproduce the key paths, so the score is conservatively limited and reduced.
Trigger conditions, exclusions, and supported Python, JavaScript/TypeScript, and Go scenarios are fairly clear, with generation, passive review, and active audit modes. Input/output contracts, non-fit boundaries, Chinese-language support, and mainland-China reachability are not established, and core fallback research may depend on overseas services, so points are deducted.
The material is layered into overview, workflow, decision tree, report format, fixes, and general advice, and agent metadata is present. License, version, changelog, maintenance ownership, update path, and complete installation/reference prerequisites are not documented in the supplied skill evidence, so points are deducted.
The skill can guide secure coding, identify issues during editing, and produce structured reports; the references contain actionable rules and remediation patterns. However, output quality depends on the target repository, complete reference coverage, and reviewer judgment, with no statically verifiable representative outputs, so the score remains below the static ceiling.
Rule IDs, detection hints, evidence requirements, and remediation formats provide some audit traceability. There are no committed tests, CI execution artifacts, or independent reproduction materials, and the supplied external citations are not directly verifiable here, so only a low score is justified.
- Core guidance depends on the references directory, which is not fully supplied; verify all relevant files in the actual package.
- The fallback permits online searching; verify network reachability, source trustworthiness, and that sensitive code is not sent to external services.
- Report path, permissions, overwrite behavior, and post-fix testing or rollback procedures are unspecified.
- License, versioning, changelog, and maintenance/update ownership are not documented.
What it does & when to use it
This skill is intended for explicit requests involving security best-practice guidance, security reviews, reports, or secure-by-default coding. It supports Python, JavaScript/TypeScript, and Go, and identifies the languages and primary frameworks in scope. It reads matching reference material to guide secure code, passive detection of major issues, or prioritized vulnerability reports. It comes from the deprecated openai/skills catalog, whose README points current examples to the OpenAI Plugins repository.
Identifies all relevant languages and primary frameworks; reads matching security documents from the skill's references directory; uses that guidance to write secure-by-default code or passively flag major vulnerabilities; produces reports with an executive summary, numbered findings, severity, urgency, impact statements, and code line numbers when requested; proposes fixes one finding at a time.
- A Python developer requests secure-by-default guidance for a backend service.
- A JavaScript or TypeScript team wants a security review and prioritized vulnerability report.
- A Go service maintainer wants major security issues identified with suggested fixes.
- A full-stack project needs security guidance checked for both its frontend and backend.
- A team wants high-impact security issues flagged passively while code is being developed.
Pros & cons
- Clear supported-language and activation scope.
- Can address both frontend and backend frameworks.
- Supports secure-by-default coding, passive vulnerability detection, and formal reports.
- Report requirements include severity, priority, identifiers, and code line numbers for easier tracking.
- Limited to Python, JavaScript/TypeScript, and Go.
- The supplied material does not include the references directory, so framework coverage cannot be confirmed.
- No test suite or validation results are provided.
- The repository is deprecated, and the individual skill license file was not supplied.
How to install
The README says curated skills can be installed in Codex with $skill-installer security-best-practices, followed by a Codex restart. The repository is deprecated, and the README recommends the OpenAI Plugins repository for current skill and plugin examples. Further installation details are not provided in the source material.
How to use
Make an explicit security request, such as “review this Python project against security best practices and produce a report” or “help me write this TypeScript code securely by default.” The skill is limited to Python, JavaScript/TypeScript, and Go; it should not trigger for general code review, debugging, or non-security tasks.
Compared to similar skills
The README names the OpenAI Plugins repository as the current source for Codex skill and plugin examples. No other functional alternative is named in the source material.