Deep Security Scan
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing...
Install
npx skills add openai/codex-security --skill deep-security-scan -g -a claude-code -y- Repository
- openai/codex-security11.3k
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,490 tokens
- Runs scripts
- No, instructions only
What it does
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent Standard scans with the Codex Security deep-scan tool. Do not use for PRs, commits, branch diffs, or working-tree diffs.
Deep Security Scan
The coordinator runs independent Standard audits, aggregates their validated findings, and finalizes plugin-launched scans even if the calling thread detaches. This thread owns setup, user context, and reporting the completed result.
Resolve the Scan
For a continuation with scanId, call get_codex_security_scan_context with the supplied handoffClaimToken when present. Preserve its authoritative identity, directory, target, scope, and context. If its validated mode is not deep, route to the corresponding top-level skill.
For a new conversation, CLI, or headless request, resolve the authorized local targetPath and optional exact userContext. For a scoped-path request, use that directory as targetPath with scope: "."; do not widen it to the repository root. If the coordinator tool is unavailable, report that the plugin server is required.
Read ../../references/scan-prologue.md for source-access, context-update, cancellation, and recovery rules. Deep has no parent capability preflight: the coordinator validates ownership, target, scope, and sandbox, and manages workers independently of this thread's delegation capacity.
Concurrent Desktop Scans
For a newly launched native scan with authoritative context, inspect otherRunningDeepScans once before discovery. If another Deep scan is running, show its target, phase in plain language, and human-friendly start time. Explain the additional CPU, memory, and token use without exposing scan IDs or raw timestamps.
Ask whether to continue, with Cancel (Recommended) and Continue. Use native request_user_input, then request_codex_security_user_input or plain chat if unavailable. Wait for an explicit choice; a declined or cancelled input dialog is not a scan cancellation. If the user cancels, cancel only the new scan. Do not repeat this guard after it passes or after preflight.
