Trigger
- Keywords: security review, OWASP, vulnerability, dep-audit, npm audit, dependency security
When NOT to Use
- General code review (use
codex-code-review) - Functional testing (use
test-review) - Performance issues (not security-related)
Commands
| Command | Purpose | When |
|---|---|---|
/codex-security |
OWASP Top 10 audit | Security-sensitive code |
/dep-audit |
Dependency security audit | Periodic / PR |
Workflow: /codex-security
Determine scope → Collect changes → Codex OWASP review → Findings + Gate → Loop if Must fix
Step 1: Determine Scope
Parse --scope from arguments, default to src/.
Step 2: Collect Change Metadata
Metadata, not content: the first dispatch carries the changed-file list and diff stats, and Codex
reads the diffs itself from the sandbox (@rules/codex-invocation.md § Required in every first-dispatch prompt). A truncated
| head -1500 excerpt was the old shape, and it decided for the reviewer which 1500 lines of a
security review mattered.
CHANGED_FILES:git diff --name-only HEAD -- <scope>∪git ls-files --others --exclude-standard -- <scope>DIFF_STAT:git diff --stat HEAD -- <scope>SCOPE: the resolved scope argument, plus the security-relevant paths aGlob("**/*{auth,login,password,token,secret,key,credential}*")surfaces — named as places to look, never pasted
Step 3: Codex Security Review
First review: dispatch per @skills/codex-code-review/references/codex-transport.md § Start with the OWASP prompt. See references/codex-prompt-security.md.
Save the returned threadId.
Loop review: dispatch per @skills/codex-code-review/references/codex-transport.md § Resume with the re-review template. See references/codex-prompt-security.md.
Step 4: Consolidate Output
Organize results into findings summary table + detailed findings + gate.
OWASP Top 10:2025
The version is part of the identifier: SSRF is no longer A10 (it sits inside A01), and A02–A06 renumbered, so a finding labelled with a 2021 code says something different to whoever reads it.
| Code | Category | Check Focus |
|---|---|---|
| A01 | Broken Access Ctrl | IDOR, permission bypass, CORS, SSRF |
| A02 | Misconfiguration | Debug mode, default passwords |
| A03 | Supply Chain Failures | Vulnerable deps, unverified build sources |
| A04 | Crypto Failures | Sensitive data encryption, weak crypto |
| A05 | Injection | SQL/NoSQL/Cmd Injection, XSS |
| A06 | Insecure Design | Rate Limiting, business logic |
| A07 | Auth Failures | Brute force, session, weak passwords |
| A08 | Integrity Failures | Deserialization, CI/CD |
| A09 | Logging & Alerting | Sensitive data in logs, auditing, alerts |
| A10 | Exceptional Conditions | Error paths that fail open or leak |
Review Loop
⚠️ @CLAUDE.md auto-loop: fix → re-review → ... → ✅ PASS ⚠️
⛔ Must fix → fix P0 issues → /codex-security --continue <threadId> → repeat until ✅ Mergeable.
Max 3 rounds. Still failing → report blocker.
Verification
- Each issue tagged with severity (P0/P1/P2)
- Gate is explicit (✅ Mergeable / ⛔ Must fix)
- Fix recommendations are specific and actionable
- Includes verification test method
- Codex independently researched auth/input/sensitive code
References
- OWASP prompt:
references/codex-prompt-security.md - Examples:
references/examples.md - Standards: @rules/security.md
Examples
Input: /codex-security --scope src/controller/
Action: OWASP Top 10 check → output issues + Gate
Input: /dep-audit --level high
Action: npm audit → filter high/critical → output report