原文核对：2026-10-13 · 中文正文 · 英文提示词与演示
场景定位
对仓库或指定目录重复发现、验证候选并分析攻击路径，形成可审阅的发现和覆盖报告。
- 难度
- 高级
- 时间跨度
- 长时间运行
适合用于
- 拥有或获准评估的仓库、组件的应用安全审查。
- 愿投入更多运行时间和 token 的全面审查。
- 修复前需要可追溯证据的安全团队。
相关工具
对仓库或目录进行多轮发现，验证保留下来的问题、分析攻击路径并报告覆盖情况。
Codex Security:deep Security Scan ↗起步提示词
英文原文 · 可复制后按实际材料修改
Use $codex-security:deep-security-scan to run a deep security scan on [this repository / absolute path to a scoped folder].
Scope and rules:
- I am authorized to assess this repository.
- Keep the scan within [the entire repository / the exact folder named above].
- Use the Codex Security plugin's deep-scan workflow; do not reinterpret this as a pull request or diff review.
Return the scan directory and report.md path. Summarize the findings, reviewed surfaces, and proof gaps that require human review first.选择深度仓库审查
需要更全面的漏洞审查且能接受较长耗时时使用。Codex Security 会重复发现，再验证和排序，因此比普通扫描消耗更多时间和资源。
可以检查整个仓库或明确包、目录；PR、提交、分支差异或工作区补丁应使用 $codex-security:security-diff-scan。
准备授权扫描
- 打开仓库并完成 Codex Security 快速入门。
- 确认拥有仓库或已获评估授权。
- 在 SECURITY.md 写架构、信任边界、安全不变量、发现标准、排除项和严重程度规则；目录专属策略用嵌套文件。
- 在 AGENTS.md 保留构建、测试、验证命令和仓库指令。
- 运行起步提示词，完成多轮发现、验证、攻击路径分析和最终报告。
- 审阅发现工作区、报告及证明缺口；按需请求详细漏洞报告或结构性加固建议。
先审阅证据再修复
结果应说明受影响位置、可达原因、验证方法、剩余证明缺口和受控修复方向，区分未验证与已验证发现。
只修复已经选定并审阅的问题，按漏洞积压流程逐项修复并做针对性回归验证。
设置、预检查、范围和耗时说明参阅 Run a deep security scan。
展开英文原文对照
Use the Codex Security plugin to run a more comprehensive audit of a repository or scoped folder that repeats discovery, validates candidates, and produces reviewable findings and coverage.
Choose a deep repository review
Use a deep scan when you need a more comprehensive vulnerability review across a repository or explicit folder and can budget for a longer run. The Codex Security plugin repeats discovery passes before validating and prioritizing findings, so this workflow takes more time and resources than an ordinary scan.
A deep scan can review an entire repository or one explicitly named package or directory. To review a pull request, commit, branch diff, or working-tree patch, use $codex-security:security-diff-scan.
Prepare an authorized scan
- Open the repository in Codex and complete the Codex Security plugin quickstart.
- Confirm that you own the repository or have authorization to assess it.
- Add architecture, trust-boundary, security-invariant, finding-criteria, exclusion, and severity guidance in SECURITY.md. Use nested SECURITY.md files for directory-specific policy.
- Keep supported build, test, and validation commands and other repository instructions in AGENTS.md.
- Run the starter prompt and let the scan complete its repeated discovery, validation, attack-path analysis, and final reporting stages.
- Review the findings workspace, report, and any proof gaps. Request detailed vulnerability reports or structural hardening guidance when you need them.
Review evidence before remediation
The final result should identify affected locations, why the behavior is reachable, what validation Codex performed, any remaining proof gaps, and a bounded remediation direction. Distinguish findings without validation evidence from validated findings.
Start remediation only for a finding you have selected and reviewed. Use Remediate a vulnerability backlog to fix findings one at a time with focused regression validation.
For setup, preflight, scoped targets, and runtime expectations, see Run a deep security scan.