What it does
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
This entry summarizes the public skill for discovery. Prefer the upstream SKILL.md for the full instruction text (we do not paste restricted or lengthy proprietary prompt bodies).
Install & usage
Codex
Inside Codex, use the skill installer (repo is deprecated as a catalog but curated skills remain usable):
$skill-installer security-best-practices
Or copy from GitHub:
mkdir -p .codex/skills
git clone --depth 1 https://github.com/openai/skills.git /tmp/openai-skills
cp -R /tmp/openai-skills/skills/.curated/security-best-practices .codex/skills/security-best-practices
Restart Codex after install so it discovers the skill.
Best for
Language/framework security reviews before shipping.
Hands-on test
- test_level: fully-tested
- Ran: yes
- When: 2026-11-01T01:20:00+08:00 (Asia/Shanghai)
- Result: Loaded Flask/Django/FastAPI reference docs and wrote REPORT.md flagging SQL injection, pickle.loads, and hardcoded secrets on a sample app.
- Gotchas: Reference pack is large; pick the matching stack file or reviews get noisy.
Money-saving tip
Prefer ChatGPT Go ($8/mo US) or Plus ($20/mo) before Pro tiers; Business annual Standard seats are $20/user/mo vs $25 monthly. Nonprofit Standard seats: $8 annual / $10 monthly (help.openai.com).
Source & license
- source_repo: openai/skills
- Source: https://github.com/openai/skills/tree/main/skills/.curated/security-best-practices
- License: Apache-2.0 — https://github.com/openai/skills/blob/main/skills/.curated/security-best-practices/LICENSE.txt
- Restrictions: Individual skill LICENSE.txt applies (usually Apache-2.0; vercel-deploy is MIT). openai/skills catalog is deprecated — prefer openai/plugins for newer examples, but these curated skills remain useful.