VibeRPGSimulator

Codex plugin and CLI that scan a repo or diff for vulnerabilities, validate findings, and draft and verify fixes.

How it works

Foe: Breach Spider, a security hole an attacker could use.

Foes

  • Breach Spider

Party · Context

  • RogueYour agent100/100

  1. Breach Spider

    The Breach Spider blocks the way.

    What really happensIt stands for a security hole an attacker could use.

    Rogue: Context 100/100.

  2. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.

  3. OpenAI Codex Security

    The Codex Security scroll is unrolled in a fresh chat.

    What really happensInstall Codex Security from /plugins, start a new chat, and ask: Run a Codex Security scan on this repository.

    Breach Spider takes 18.

  4. OpenAI Codex Security

    The scroll reads every gate, or only the new ones.

    What really happens$security-scan audits the repo or chosen paths, $security-diff-scan reviews a PR or branch diff, and $deep-security-scan repeats audits.

    Breach Spider takes 15.

  5. Exploit

    The Breach Spider uses Exploit.

    Rogue takes 11. Rogue: Context 78/100.

  6. OpenAI Codex Security

    Each claimed hole is tested against the source.

    What really happensCandidate findings are validated with source evidence and attacker prerequisites. $triage-finding gives one verdict per supplied report.

    Breach Spider takes 36.

  7. OpenAI Codex Security

    The spider's map is saved, with gaps marked in ink.

    What really happensThe scan saves report.md, findings.json and coverage.json. Ask $fix-finding for a patch, then $verify-fix to check it.

    Breach Spider takes 31. Breach Spider falls.

  8. Victory

    The Breach Spider falls.

Learn this spell

Codex

npm install --global @openai/codex-security
cs login

Notes

In Codex, enter /plugins, search Codex Security and install it, then ask for a scan. Skills include $security-scan, $security-diff-scan, $deep-security-scan, $triage-finding, $fix-finding and $verify-fix. The CLI (cs scan .) needs Node 22.13+, 24 or 26 and Python 3.10+. Scans save report.md, findings and coverage and leave source unchanged. Some requests and protected findings need Trusted Access for Cyber approval. A scan with no findings does not prove the repo is secure.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.