Show HN: Code Security Skills Codex-Inspired Workflows Packaged for Claude Code

Developer Bar Vhaim released Code Security Skills, an open-source repository of 13 evidence-driven workflows for threat modeling, code review, and vulnerability remediation, packaged as a Claude Code plugin. The provider-neutral plugin, available via the Claude Code plugin marketplace, includes commands for security-diff-scan, deep-security-scan, and attack-path analysis, and outputs structured findings in a deterministic contract format including scan-manifest.json, findings.json, and SARIF exports.

Thirteen evidence-driven workflows for threat modeling, code review, finding validation, attack-path analysis, remediation, tracking, and deterministic security reporting. The procedures are provider-neutral: they describe required capabilities and evidence, not a particular model, coordinator, desktop application, or proprietary service. This repository packages them as a Claude Code plugin. Open Claude Code and run: /plugin marketplace add barvhaim/code-security-skills /plugin install code-security-skills@code-security /reload-plugins Review the current branch, PR, commit, staged changes, or working tree: /code-security-skills:security-diff-scan Review the current working tree for security regressions. Do not modify files. Or scan the whole repository: /code-security-skills:security-scan Scan this repository. Do not modify source files. By default, scan artifacts are written outside the target repository under the active system temporary directory at code-security-scans/<repository / ; you can select another output directory. | Goal | Command | |---|---| | Review a PR, commit, branch, patch, staged changes, or working tree | /code-security-skills:security-diff-scan | | Run the default single-pass repository audit | /code-security-skills:security-scan | | Run repeated independent discovery passes for higher recall | /code-security-skills:deep-security-scan | | Map assets, trust boundaries, entry points, and abuse cases | /code-security-skills:threat-model | | Investigate a candidate vulnerability | /code-security-skills:finding-discovery | | Reproduce or disprove a candidate finding | /code-security-skills:validation | | Connect validated findings into attacker journeys | /code-security-skills:attack-path-analysis | | Draft a vulnerability report | /code-security-skills:vulnerability-writeup | | Implement and verify a narrow fix | /code-security-skills:fix-finding | | Propose hardening without editing source | /code-security-skills:propose-security-hardening | | Triage a ticket, advisory, or report | /code-security-skills:triage-finding | | Synchronize validated findings with trackers | /code-security-skills:track-findings | | Define a repository security policy | /code-security-skills:define-security-policy | Each workflow declares the capability it needs instead of assuming a named host runtime: - Repository access through file, search, and bounded shell capabilities. - Optional independent workers or subagents for repeated discovery passes. - Explicit tracker capabilities for identity, search, mutation, and exact readback. - Optional host-native review annotations only when the host documents them. - Deterministic local helpers for normalization, validation, sealing, report generation, and SARIF export. Claude Code supplies the current packaging and command namespace. The procedures can be adapted to another coding agent that offers equivalent capabilities and preserves the same trust boundaries. The scan workflows produce the provider-neutral code-security contract: scan-manifest.json for target identity, scope, status, producer, and artifact hashes. findings.json for structured findings, evidence, confidence, severity, and remediation. coverage.json for reviewed surfaces, exclusions, and deferred work. report.md as a deterministic human-readable projection. exports/results.sarif for compatible code-scanning tools. The contract uses independent document types, schema identifiers, producer names, fingerprints, snapshot digests, and SARIF properties. It is not presented as wire-compatible with the upstream source contract. A bundled deterministic fixture demonstrates the final output without model credentials: | Result | Value | |---|---| | Finding | Unsafe archive extraction can escape the output directory | | Severity | High, CVSS 8.1 | | Confidence | High | | Taxonomy | CWE-22, path traversal | | Coverage | Complete | View the generated example report /barvhaim/code-security-skills/blob/main/plugins/code-security-skills/examples/completed-scan/report.md and SARIF export /barvhaim/code-security-skills/blob/main/plugins/code-security-skills/examples/completed-scan/exports/results.sarif . The example proves deterministic artifact generation, not model accuracy. The skills share references, schemas, artifact contracts, and deterministic helpers. Packaging them together preserves relative links and installs one coherent workflow instead of thirteen incomplete fragments. Claude Code discovers each skill independently under the code-security-skills namespace. Add a local checkout as a marketplace: /plugin marketplace add /absolute/path/to/code-security-skills /plugin install code-security-skills@code-security /reload-plugins Or load only the plugin during development: claude --plugin-dir ./plugins/code-security-skills Run the verification suite: python3 -m unittest discover -s tests -v python3 scripts/check portability.py python3 scripts/smoke finalize.py python3 scripts/smoke plugin load.py claude plugin validate . claude plugin validate ./plugins/code-security-skills See PROVENANCE.md /barvhaim/code-security-skills/blob/main/plugins/code-security-skills/PROVENANCE.md for the exact derivation and runtime boundary. .claude-plugin/marketplace.json plugins/code-security-skills/ ├── .claude-plugin/plugin.json ├── skills/ ├── references/ ├── scripts/ ├── schemas/ ├── examples/ ├── PROVENANCE.md ├── THIRD PARTY NOTICES.md └── UPSTREAM SOURCE.json Installing this plugin installs prompts, references, schemas, examples, and deterministic Python helpers. It does not install a coordinator, hosted scanning service, model credentials, tracker integration, or desktop application. Linear and Jira tracking require separately configured MCP or tool integrations with identity, search, mutation, and exact-readback capabilities. GitHub tracking can use an explicitly selected authenticated gh identity. Schema-valid output does not prove that a model-generated finding is correct or that every vulnerability was found. Review findings before making consequential security decisions. Read CONTRIBUTING.md /barvhaim/code-security-skills/blob/main/CONTRIBUTING.md before changing derivative files or the artifact contract. Report vulnerabilities according to . /barvhaim/code-security-skills/blob/main/SECURITY.md SECURITY.md Code Security Skills is an independent, unofficial derivative of workflows originally published in OpenAI Codex Security https://github.com/openai/codex-security . It is not affiliated with or endorsed by OpenAI or Anthropic. - Pinned source revision: f22d4a36f26d16287bcdfd707b369116e02a08c3 - Original copyright: Copyright 2025 OpenAI - License: Apache License 2.0 See LICENSE /barvhaim/code-security-skills/blob/main/LICENSE , , /barvhaim/code-security-skills/blob/main/plugins/code-security-skills/PROVENANCE.md PROVENANCE.md , and /barvhaim/code-security-skills/blob/main/plugins/code-security-skills/THIRD PARTY NOTICES.md THIRD PARTY NOTICES.md . /barvhaim/code-security-skills/blob/main/plugins/code-security-skills/UPSTREAM SOURCE.json UPSTREAM SOURCE.json