{"slug": "show-hn-code-security-skills-codex-inspired-workflows-packaged-for-claude-code", "title": "Show HN: Code Security Skills Codex-Inspired Workflows Packaged for Claude Code", "summary": "Developer Bar Vhaim released Code Security Skills, an open-source repository of 13 evidence-driven workflows for threat modeling, code review, and vulnerability remediation, packaged as a Claude Code plugin. The provider-neutral plugin, available via the Claude Code plugin marketplace, includes commands for security-diff-scan, deep-security-scan, and attack-path analysis, and outputs structured findings in a deterministic contract format including scan-manifest.json, findings.json, and SARIF exports.", "body_md": "Thirteen evidence-driven workflows for threat modeling, code review, finding validation, attack-path analysis, remediation, tracking, and deterministic security reporting.\n\nThe procedures are provider-neutral: they describe required capabilities and evidence, not a particular model, coordinator, desktop application, or proprietary service. This repository packages them as a Claude Code plugin.\n\nOpen Claude Code and run:\n\n```\n/plugin marketplace add barvhaim/code-security-skills\n/plugin install code-security-skills@code-security\n/reload-plugins\n```\n\nReview the current branch, PR, commit, staged changes, or working tree:\n\n```\n/code-security-skills:security-diff-scan Review the current working tree for security regressions. Do not modify files.\n```\n\nOr scan the whole repository:\n\n```\n/code-security-skills:security-scan Scan this repository. Do not modify source files.\n```\n\nBy default, scan artifacts are written outside the target repository under the active system temporary directory at `code-security-scans/<repository>/`\n\n; you can select another output directory.\n\n| Goal | Command |\n|---|---|\n| Review a PR, commit, branch, patch, staged changes, or working tree | `/code-security-skills:security-diff-scan` |\n| Run the default single-pass repository audit | `/code-security-skills:security-scan` |\n| Run repeated independent discovery passes for higher recall | `/code-security-skills:deep-security-scan` |\n| Map assets, trust boundaries, entry points, and abuse cases | `/code-security-skills:threat-model` |\n| Investigate a candidate vulnerability | `/code-security-skills:finding-discovery` |\n| Reproduce or disprove a candidate finding | `/code-security-skills:validation` |\n| Connect validated findings into attacker journeys | `/code-security-skills:attack-path-analysis` |\n| Draft a vulnerability report | `/code-security-skills:vulnerability-writeup` |\n| Implement and verify a narrow fix | `/code-security-skills:fix-finding` |\n| Propose hardening without editing source | `/code-security-skills:propose-security-hardening` |\n| Triage a ticket, advisory, or report | `/code-security-skills:triage-finding` |\n| Synchronize validated findings with trackers | `/code-security-skills:track-findings` |\n| Define a repository security policy | `/code-security-skills:define-security-policy` |\n\nEach workflow declares the capability it needs instead of assuming a named host runtime:\n\n- Repository access through file, search, and bounded shell capabilities.\n- Optional independent workers or subagents for repeated discovery passes.\n- Explicit tracker capabilities for identity, search, mutation, and exact readback.\n- Optional host-native review annotations only when the host documents them.\n- Deterministic local helpers for normalization, validation, sealing, report generation, and SARIF export.\n\nClaude Code supplies the current packaging and command namespace. The procedures can be adapted to another coding agent that offers equivalent capabilities and preserves the same trust boundaries.\n\nThe scan workflows produce the provider-neutral `code-security`\n\ncontract:\n\n`scan-manifest.json`\n\nfor target identity, scope, status, producer, and artifact hashes.`findings.json`\n\nfor structured findings, evidence, confidence, severity, and remediation.`coverage.json`\n\nfor reviewed surfaces, exclusions, and deferred work.`report.md`\n\nas a deterministic human-readable projection.`exports/results.sarif`\n\nfor compatible code-scanning tools.\n\nThe contract uses independent document types, schema identifiers, producer names, fingerprints, snapshot digests, and SARIF properties. It is not presented as wire-compatible with the upstream source contract.\n\nA bundled deterministic fixture demonstrates the final output without model credentials:\n\n| Result | Value |\n|---|---|\n| Finding | Unsafe archive extraction can escape the output directory |\n| Severity | High, CVSS 8.1 |\n| Confidence | High |\n| Taxonomy | CWE-22, path traversal |\n| Coverage | Complete |\n\nView the generated [example report](/barvhaim/code-security-skills/blob/main/plugins/code-security-skills/examples/completed-scan/report.md) and [SARIF export](/barvhaim/code-security-skills/blob/main/plugins/code-security-skills/examples/completed-scan/exports/results.sarif). The example proves deterministic artifact generation, not model accuracy.\n\nThe skills share references, schemas, artifact contracts, and deterministic helpers. Packaging them together preserves relative links and installs one coherent workflow instead of thirteen incomplete fragments. Claude Code discovers each skill independently under the `code-security-skills`\n\nnamespace.\n\nAdd a local checkout as a marketplace:\n\n```\n/plugin marketplace add /absolute/path/to/code-security-skills\n/plugin install code-security-skills@code-security\n/reload-plugins\n```\n\nOr load only the plugin during development:\n\n```\nclaude --plugin-dir ./plugins/code-security-skills\n```\n\nRun the verification suite:\n\n```\npython3 -m unittest discover -s tests -v\npython3 scripts/check_portability.py\npython3 scripts/smoke_finalize.py\npython3 scripts/smoke_plugin_load.py\nclaude plugin validate .\nclaude plugin validate ./plugins/code-security-skills\n```\n\nSee [ PROVENANCE.md](/barvhaim/code-security-skills/blob/main/plugins/code-security-skills/PROVENANCE.md) for the exact derivation and runtime boundary.\n\n```\n.claude-plugin/marketplace.json\nplugins/code-security-skills/\n├── .claude-plugin/plugin.json\n├── skills/\n├── references/\n├── scripts/\n├── schemas/\n├── examples/\n├── PROVENANCE.md\n├── THIRD_PARTY_NOTICES.md\n└── UPSTREAM_SOURCE.json\n```\n\nInstalling this plugin installs prompts, references, schemas, examples, and deterministic Python helpers. It does not install a coordinator, hosted scanning service, model credentials, tracker integration, or desktop application.\n\nLinear and Jira tracking require separately configured MCP or tool integrations with identity, search, mutation, and exact-readback capabilities. GitHub tracking can use an explicitly selected authenticated `gh`\n\nidentity.\n\nSchema-valid output does not prove that a model-generated finding is correct or that every vulnerability was found. Review findings before making consequential security decisions.\n\nRead [ CONTRIBUTING.md](/barvhaim/code-security-skills/blob/main/CONTRIBUTING.md) before changing derivative files or the artifact contract. Report vulnerabilities according to\n\n[.](/barvhaim/code-security-skills/blob/main/SECURITY.md)\n\n`SECURITY.md`\n\nCode Security Skills is an independent, unofficial derivative of workflows originally published in [OpenAI Codex Security](https://github.com/openai/codex-security). It is not affiliated with or endorsed by OpenAI or Anthropic.\n\n- Pinned source revision:\n`f22d4a36f26d16287bcdfd707b369116e02a08c3`\n\n- Original copyright: Copyright 2025 OpenAI\n- License: Apache License 2.0\n\nSee [ LICENSE](/barvhaim/code-security-skills/blob/main/LICENSE),\n\n[,](/barvhaim/code-security-skills/blob/main/plugins/code-security-skills/PROVENANCE.md)\n\n`PROVENANCE.md`\n\n[, and](/barvhaim/code-security-skills/blob/main/plugins/code-security-skills/THIRD_PARTY_NOTICES.md)\n\n`THIRD_PARTY_NOTICES.md`\n\n[.](/barvhaim/code-security-skills/blob/main/plugins/code-security-skills/UPSTREAM_SOURCE.json)\n\n`UPSTREAM_SOURCE.json`", "url": "https://wpnews.pro/news/show-hn-code-security-skills-codex-inspired-workflows-packaged-for-claude-code", "canonical_source": "https://github.com/barvhaim/code-security-skills", "published_at": "2026-07-29 08:16:01+00:00", "updated_at": "2026-07-29 08:22:43.633965+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-agents", "ai-safety"], "entities": ["Bar Vhaim", "Claude Code", "Code Security Skills", "SARIF"], "alternates": {"html": "https://wpnews.pro/news/show-hn-code-security-skills-codex-inspired-workflows-packaged-for-claude-code", "markdown": "https://wpnews.pro/news/show-hn-code-security-skills-codex-inspired-workflows-packaged-for-claude-code.md", "text": "https://wpnews.pro/news/show-hn-code-security-skills-codex-inspired-workflows-packaged-for-claude-code.txt", "jsonld": "https://wpnews.pro/news/show-hn-code-security-skills-codex-inspired-workflows-packaged-for-claude-code.jsonld"}}