Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Install
npx skills add openai/plugins --skill attack-path-analysisnpx skills add openai/plugins --skill attack-path-analysis -a claude-code -gnpx skills add openai/plugins --skill attack-path-analysis -a codex -ggemini skills install https://github.com/openai/plugins.git --path plugins/codex-security/skills/attack-path-analysisgh skill install openai/plugins attack-path-analysisgit clone --depth 1 https://github.com/openai/plugins /tmp/openai__plugins
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/openai__plugins/plugins/codex-security/skills/attack-path-analysis ~/.claude/skills/attack-path-analysis # Claude Code
cp -R /tmp/openai__plugins/plugins/codex-security/skills/attack-path-analysis ~/.agents/skills/attack-path-analysis # Codex, Cursor, Gemini CLI, Copilot, OpenCode