SECURITY / OpenAI
OpenAI Codex Security Threat Model
Creates or reuses a repository threat model bound to the actual target and revision, preserving supplied context and explicit review gaps.
“Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create,”
01 / THE REASONING
Why this made the selection.
- Binds reusable models to repository/version identity and avoids mixing scan-specific context into a shared cache.
- Treats repository security policies as analysis data and separates threat hypotheses from validated findings.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/codex-security/skills/threat-model/SKILL.md
- plugins/codex-security/references/scan-artifacts.md
- plugins/codex-security/references/security-guidance.md
- plugins/codex-security/references/threat-model.md
- plugins/codex-security/.codex-plugin/plugin.json
Our findings
- A supplied or context-specific model bypasses shared-cache reuse and replacement under the documented rules.
- The threat-model reference follows concrete consumers, configuration precedence and deployment paths instead of inferring boundaries from names.
- It requests an independent architecture review where supported and explicitly labels a sequential fallback as non-independent.
Not established by this review
- Source inspection only; no skill installation or workflow execution was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
- Use the complete codex-security Codex plugin through its supported distribution and setup instructions.
- Retain plugin-level references and companion skills; this is not a standalone SKILL.md installation.
- Confirm plugin availability and any required connectors in the Codex host before invoking the workflow.
Before you start
- A Codex host with access to this plugin and its applicable service terms
- Authorized repository scope and required plugin references
- Applicable Codex Security access
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/openai/plugins/blob/1dc195897af4161d039b80d8471ec0a10c9bbc89/plugins/codex-security/skills/threat-model/SKILL.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, compatibility, access
https://github.com/openai/plugins/blob/1dc195897af4161d039b80d8471ec0a10c9bbc89/plugins/codex-security/references/scan-artifacts.md
Supports: review, limitations, access
https://github.com/openai/plugins/blob/1dc195897af4161d039b80d8471ec0a10c9bbc89/plugins/codex-security/references/security-guidance.md
Supports: review, limitations, access
https://github.com/openai/plugins/blob/1dc195897af4161d039b80d8471ec0a10c9bbc89/plugins/codex-security/references/threat-model.md
Supports: review, limitations, access
https://github.com/openai/plugins/blob/1dc195897af4161d039b80d8471ec0a10c9bbc89/plugins/codex-security/.codex-plugin/plugin.json
Supports: license
https://github.com/openai/plugins/blob/1dc195897af4161d039b80d8471ec0a10c9bbc89/README.md
Supports: install, compatibility, access
https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md
Supports: install