Tools

Addy Osmani's production-grade engineering skill pack covering spec, planning, implementation, testing, review and shipping, with commands like /spec, /plan, /build, /test, /review and /ship. Supports both Claude Code and Codex.

Calls Codex from Claude Code for read-only or adversarial code reviews, or delegates tasks to Codex to run in the background. Maintained by OpenAI; needs a ChatGPT account (the free tier works) or an API key.

OpenAI's official security CLI and TypeScript SDK: scans codebases to find, validate and fix security vulnerabilities, and can draft a SECURITY.md policy. Needs Node.js 22.13+, Python 3.10+, and a ChatGPT sign-in or API key.

Annotate and review agent-generated plans, docs and code diffs in the browser, then send feedback back to the agent in one click. Hooks into plan mode and supports Claude Code, Codex and other agents. Run the official install script to set up the CLI first.

Security scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.