Tools

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

Query, modify and convert JSON, YAML, TOML, XML, CSV, HCL, INI and more with one selector syntax, editing config files in place or converting between formats, handy for agents handling structured data in scripts. A single dependency-free binary that works much like jq or yq.

Open-source font editor: fontforge -script runs Python scripts headlessly to batch-edit glyphs, convert between OTF, TTF, UFO and other formats, and generate fonts, for type design and font processing. Homebrew installs the CLI version; install the desktop app for the GUI.

Query cloud resources and SaaS APIs live with SQL: plugins map AWS, Azure, GCP, GitHub, Kubernetes and other services to tables you can select from directly, no ETL needed. A single binary with Postgres built in.

Diffusion model inference in pure C/C++: one sd-cli command runs SD, FLUX, Qwen Image, Wan and more locally to create or edit images and short videos, with Metal acceleration on Mac. No cloud needed; bring your own model weights and use a release binary or build from source.

OpenAI's official Codex plugin that turns early product ideas, live pages or screenshots into interactive prototypes, proposing a few visual directions before building. Also reviews user flows, researches user pain points and checks accessibility issues.

OpenAI's official Codex plugin marketplace (openai-curated) with 60+ plugins such as Figma, Notion, GitHub, Stripe and Vercel, each bundling skills, MCP servers and app connections into one install.

Has the agent build a local Next.js editor that turns app screenshots into App Store and Google Play marketing images: real device frames, bold headlines, 18 visual styles, multiple languages and RTL layouts, with one-click export of every required size. Needs Node.js.

Reproduces issues on the Android emulator: installs builds, drives the UI with adb, dumps the UI tree, takes screenshots, captures logcat, and gathers performance evidence with Simpleperf and Perfetto. OpenAI's official Codex plugin; needs the Android SDK.

Tests and debugs a locally running frontend with Codex's Browser plugin or Playwright: checks blank pages, framework and console errors, captures screenshots, re-verifies after fixes and writes a QA report. Maintained by OpenAI; formerly playwright-interactive in openai/skills.

Creates, edits and validates reproducible Python and SQL Jupyter notebooks: organizes cells as reports or tutorials, checks conclusions against actual output and reruns top to bottom before handoff. Maintained by OpenAI in the Data Analytics plugin of openai/plugins.

OpenAI's official Codex plugin for adding the OpenAI Ads measurement pixel and optional Conversions API (CAPI) to a website, with local validation scripts plus key and deduplication guidance. Needs the site's source and an OpenAI Ads account; review manually before launch.

OpenAI's official Codex plugin that starts from a brief, product shots or references to generate marketing concepts, mood boards, product scenes, ad directions and social assets, compared and iterated on a reviewable board. Works with Figma and Canva.

Figma's Codex plugin in OpenAI's official marketplace: implements UI from designs, generates Code Connect mappings, and creates or updates pages, component libraries, FigJam diagrams and slides in Figma. Needs a connected Figma account.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.

Linear's official plugin in OpenAI's Codex marketplace: search, create and update Linear issues, projects and initiatives from Codex, and draft PRDs, status updates and customer request summaries. Codex only; needs a Linear account and authorization.

MagicPath's official Codex plugin from OpenAI's plugin marketplace: search and install UI components from MagicPath canvases, apply team themes, and move interfaces from local code onto the canvas to keep iterating. Needs a MagicPath account and Node.js.

OpenAI's official Codex plugin for building frontend apps and generating visual assets, testing and debugging in a browser, plus best-practice skills for React, shadcn/ui, Stripe payments and Supabase databases. Codex only.

Build with OpenAI best practices inside Codex: call the OpenAI API, build and deploy agents with the Agents SDK, create ChatGPT apps and prepare submission materials, and create API keys directly. Maintained by OpenAI; Codex only.

Builds, refactors and debugs ChatGPT apps with the OpenAI Apps SDK: plans tools, scaffolds the MCP server and UI widgets, and checks the work against official docs. Maintained by OpenAI; formerly chatgpt-apps in openai/skills.

Adobe's official Codex plugin, listed in OpenAI's plugin marketplace: batch-edit and retouch photos by chat, build social graphics from Express templates, reformat landscape video into vertical shorts and search Creative Cloud assets. Try it as a guest; sign in for more features.

Turns a Notion PRD or feature spec into an implementation plan page and tasks, flagging open questions and linking spec, plan and tasks while tracking progress. From OpenAI's official plugin repo (developer: Notion); needs the Notion MCP connected.