Agent skill · OpenAI
Security Best Practices Review
Officialname: security-best-practices★ 28k (repo)pushed 2026-09-08Apache-2.0SKILL.md on GitHubchecked 2026-10-24
Install
The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs
npx skills add openai/skills --skill security-best-practices
Copy the skill folder into ~/.claude/skills (all projects) or .claude/skills (this repo). Claude Code picks it up without a restart. docs
npx skills add openai/skills --skill security-best-practices -a claude-code # or by hand: git clone --depth 1 https://github.com/openai/skills.git /tmp/security-best-practices-src cp -r /tmp/security-best-practices-src/skills/.curated/security-best-practices ~/.claude/skills/security-best-practices
Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs
git clone --depth 1 https://github.com/openai/skills.git /tmp/security-best-practices-src cp -r /tmp/security-best-practices-src/skills/.curated/security-best-practices ./security-best-practices zip -r security-best-practices.zip security-best-practices
It's in OpenAI's own catalog: ask Codex for $skill-installer security-best-practices, or use the skills CLI. docs
$skill-installer security-best-practices
gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs
gh skill install openai/skills security-best-practices
Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs
npx skills add openai/skills --skill security-best-practices -a cursor
Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs
gemini skills install https://github.com/openai/skills.git --path skills/.curated/security-best-practices
OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs
npx skills add openai/skills --skill security-best-practices -a opencode
Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs
npx skills add openai/skills --skill security-best-practices -a windsurf
More from openai/skills
- ChatGPT Apps: Scaffolds and debugs ChatGPT apps built with the Apps SDK: an MCP server plus widget UI.
- GitHub: Address PR Comments: Works through review comments on the current branch's pull request using the gh CLI.
- GitHub: Fix CI: Reads failing GitHub Actions checks with gh, summarizes the cause and proposes a fix.
- Image Generation: Generates or edits raster images such as illustrations, sprites, mockups and transparent cutouts.
- Linear: Reads, creates and updates Linear issues and projects from the agent.
- OpenAI Docs: Looks up current OpenAI API and Codex documentation and helps pick a model.
- Playwright Browser Automation: Automates a real browser from the terminal for form filling, snapshots, scraping and UI debugging.
- Security Threat Model: Writes a threat model for a repository: trust boundaries, assets, attack paths and mitigations.
- Skill Installer (Codex): Codex's built-in helper that installs skills from the curated list or any GitHub repo path.
Other security & auth skills
- Sign In With Google (Web) · Google
- Agentic Actions Auditor · Trail of Bits
- CodeQL Scan · Trail of Bits
- Constant-Time Analysis · Trail of Bits
- Differential Security Review · Trail of Bits
- Semgrep Rule Creator · Trail of Bits
- Sharp Edges · Trail of Bits
- Security Review (Sentry) · Sentry
FAQ
How do I install the security-best-practices skill?+
Run npx skills add openai/skills --skill security-best-practices and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/security-best-practices/SKILL.md.
Which agents can use Security Best Practices Review?+
Any agent that reads the Agent Skills format (SKILL.md): Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.
Who maintains Security Best Practices Review?+
OpenAI, the company or project behind it, in the openai/skills repo on GitHub, last pushed 2026-09-08.
Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. All agent skills · MCP servers