Codex 雙層安全發布驗證工具

這是一個採取失敗即阻擋策略的 Codex Skill：先在本機稽核密鑰、個資與 Git 歷史，再驗證已完成的 Codex Security AppSec 掃描產物，最後產生一個 保守的發布判定。

A fail-closed Codex Skill that combines a deterministic public-release audit with verified canonical artifacts from OpenAI Codex Security.

This is a community-maintained orchestration Skill, not an OpenAI product. It does not vendor, modify, or impersonate Codex Security.

Why combine both layers?

A repository can be free of application vulnerabilities and still leak a token, personal email, public IP, credential-bearing remote, or deleted secret in reachable Git history. It can also pass a leak scan while still containing an exploitable authorization, injection, traversal, or trust-boundary flaw.

This Skill keeps those concerns separate and produces one conservative verdict:

1. Local release audit — deterministic, redacting, read-only, and network-free.
2. Codex Security artifact gate — optional validation of a completed official AppSec scan.

The AppSec layer is never started by the bundled scripts. Installation, authentication, model use, and scanning remain explicit external actions.

What the local layer checks

• credential and private-key patterns
• personal email and public IPv4 exposure
• sensitive filenames and local artifacts
• credential-bearing Git remotes
• staged, working-tree, tracked-tree, and reachable-history content
• commit email exposure
• symlinks and unexpected binaries
• GitHub Actions permissions and unpinned Actions

Matched values, remote URLs, and symlink targets are never printed.

What the Codex Security layer verifies

The combiner accepts only the canonical Codex Security 1.0 documents:

• scan-manifest.json
• findings.json
• coverage.json

It verifies document types, schema versions, completed scan status, matching scan IDs, canonical references, coverage consistency, regular-file boundaries, artifact location outside the target repository, size limits, and manifest SHA-256 hashes.

The combined report omits raw summaries, code evidence, attack paths, remediation text, PoCs, remote URLs, and absolute local paths.

Requirements

• Python 3.10 or later
• Git
• Optional: access to the official Codex Security Plugin or CLI for the AppSec phase

Codex Security CLI/SDK availability and entitlement are separate from this Skill.

Install as a Codex Skill

PowerShell:

$codexHome = if ($env:CODEX_HOME) { $env:CODEX_HOME } else { Join-Path $HOME '.codex' }
Copy-Item -Recurse -Force .\skills\verified-secure-release (Join-Path $codexHome 'skills\verified-secure-release')

Bash:

codex_home="${CODEX_HOME:-$HOME/.codex}"
cp -R skills/verified-secure-release "$codex_home/skills/verified-secure-release"

Restart Codex or open a new task so the Skill inventory is reloaded.

Run the local preflight

Before making an existing repository public, scan reachable history:

python -B -X utf8 skills/verified-secure-release/scripts/verified_secure_release.py . --mode all --profile release-only --format json

Stop unless the release audit returns PASS. A staged-only scan does not prove that reachable history is clean.

Combine a completed Codex Security scan

Keep the official scan output private and outside the repository. After obtaining the three canonical files from one completed scan:

python -B -X utf8 skills/verified-secure-release/scripts/verified_secure_release.py . --mode all --profile full --codex-security-dir ../private-codex-security-results --format json

Write a private combined report outside the repository:

python -B -X utf8 skills/verified-secure-release/scripts/verified_secure_release.py . --mode all --profile full --codex-security-dir ../private-codex-security-results --output ../verified-secure-release.json --format json

The output path must not already exist. The script refuses to write a combined report inside the target repository.

Verdicts

Verdict	Meaning	Exit code
PASS	Every phase selected by the profile completed without an active finding	0
REVIEW	Non-blocking local or AppSec findings require human review	1
BLOCKED	A blocking leak/privacy/workflow finding or high/critical AppSec finding remains	1
PARTIAL	The AppSec phase was not run or coverage is partial/unknown	2
INCOMPLETE	A scanner, schema, path, or artifact-integrity error prevented completion	2

Safety boundaries

• no network calls from the bundled scripts
• no automatic Codex Security installation, login, or scan
• no staging, commits, pushes, publication, history rewriting, remote changes, hooks, or patches
• no raw AppSec evidence or release-audit match values in the combined report
• no pass on missing artifacts, hash mismatch, unsupported schema, partial coverage, scanner errors, or zero unverified candidates
• no overwriting an existing combined report

Repository layout

skills/verified-secure-release/
  SKILL.md
  agents/openai.yaml
  references/codex-security-integration.md
  scripts/audit_release.py
  scripts/verified_secure_release.py
  tests/test_audit_release.py
  tests/test_verified_secure_release.py

Development

python -B -X utf8 tests/validate_skill.py
python -B -X utf8 -m unittest discover -s skills/verified-secure-release/tests -p "test_*.py" -v

The tests use disposable local Git repositories and synthetic credentials. They do not call a network service or invoke Codex Security.

中文摘要

這個 Skill 先在本機檢查 Token、個資、Git 歷史與發布外洩；只有本機階段通過後，才允許整合已完成的官方 Codex Security 掃描結果。合併器不會自行安裝、登入、上傳程式碼、執行掃描、修補或發布。

Upstream and attribution

• The deterministic scanner is vendored from Fuika0306/codex-public-release-audit under the MIT License.
• The canonical artifact contract is based on the public openai/codex-security schema version 1.0. No OpenAI source code is vendored by this integration.

License

MIT