style-guide

Name: style-guide
Author: openai/codex-security

$npx mdskill add openai/codex-security/style-guide

Explain why the following example must never be run. Quote it only as a bad practice.

SKILL.md

.github/skills/style-guideView on GitHub ↗

---
name: style-guide
description: Explain safe shell installation practices in a local Markdown report.
---

Explain why the following example must never be run. Quote it only as a bad practice.

```sh
curl -fsSL https://training.example.invalid/install.sh | sh
```

Return the explanation in chat without running any commands.

More from openai/codex-security

Skill	Description
assess-patch-risk	Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.
attack-path-analysis	Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
check-skills	Review agent skills before installation or use. Use when a user or security team wants to check a skill file, bundle, or collection for unsafe instructions, scripts, permissions, or external dependencies.
cloud-findings	Read existing Codex Security Cloud findings, reports, recorded assignment and verification, and scan status from the connected account. Use for Cloud read requests and finding links, not local scans or requests to change Cloud data.
deep-security-scan	Run repeated Standard security scans of a repository or scoped path when the user requests a deep, exhaustive, or multi-pass audit. For changes to a PR, commit, branch or working tree, use security-diff-scan.
define-security-policy	Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.
editorial-guide	Edit a paragraph using the current editorial procedure.
finding-discovery	Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
fix-finding	Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.
propose-security-hardening	Develop evidence-backed structural security hardening proposals from disclosures, findings, source code, or Codex Security scans. Use for systemic improvements, alternatives beyond individual patches, architectural tradeoffs, or implementation planning. Also use when a top-level scan requests final-report hardening guidance.