메뉴
Security audit and attack-surface decomposition. Use when Codex needs to review code changes, modules, dependencies, privileged operations, network boundaries, parsing, filesystem use, authn/authz, crypto, subprocesses, or supply chain risk.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Scoped implementation-quality review. Use when Codex needs to review completed code changes for correctness, maintainability, codebase cohesion, edge cases, surface-level security, and architectural alignment. Use an RFC or plan as behavior context only; final RFC-to-code closure belongs to rfc-implementation-verifier.
Final RFC-to-code closure review. Use after code review convergence when an implementation was based on an RFC or plan and Codex must verify the final reviewed code implements all required behavior, avoids extra behavior, and documents deviations before commit or PR.
Review-loop convergence diagnosis. Use when repeated code review or gating findings suggest unresolved architecture, requirement, invariant, ownership, or abstraction problems rather than independent bugs.
Strict dirty-tree gating review. Use when Codex needs to review only the uncommitted changes in the current repository, investigate the surrounding code, and emit tightly qualified findings in the repository's gating-review JSON style.
Subtractive plan minimality review. Use after RFC or plan review convergence to identify non-load-bearing content, inflated site lists, premature abstraction, or defensive structure not justified by the stated scope or prior blocking findings.
Adversarial technical plan stress testing. Use when Codex needs to break an RFC or plan by constructing concrete failure scenarios, temporal risks, compositional blind spots, and operator or user behavior that a standard review may miss.
| name | security-researcher |
| description | Security audit and attack-surface decomposition. Use when Codex needs to review code changes, modules, dependencies, privileged operations, network boundaries, parsing, filesystem use, authn/authz, crypto, subprocesses, or supply chain risk. |
Read ../../../roles/security-researcher.md before acting. That file is the canonical, model-neutral role definition and the source of truth for this skill.
Also read only the needed supporting files:
../../../contracts/finding.md../../../contracts/scope-block.md../../../policies/synthesis.md../../../policies/scope-discipline.md../../../policies/contract-enforcement.md../../../vocabulary.mdIf the relative paths are unavailable, try the same files under the configured Codex home ($CODEX_HOME when set, otherwise ~/.codex).