スキル openai-docs
📦
openai-docs
コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス⚙️ 外部コマンド📁 ファイルシステムへのアクセス⚡ スクリプトを含む🔑 環境変数
Find Current OpenAI and Codex Documentation
OpenAI products, models, and APIs change quickly, making remembered guidance unreliable. This skill retrieves current official documentation and provides concise, cited answers.
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "openai-docs" from https://skillstore.io/skills/openai-docs.md and its manifest at https://skillstore.io/api/skills/openai-docs/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「openai-docs」を使用しています。 Which OpenAI API should handle a stateful tool-using workflow?
期待される結果:
Recommendation: use the documented Responses API workflow. The answer explains state handling, tool calls, limitations, and cites the relevant official guide.
「openai-docs」を使用しています。 Plan our migration from a named model to a newer target.
期待される結果:
- Target decision based on current official model guidance.
- Compatibility changes for requests, tools, reasoning, and state.
- Prompt updates only where documented behavior requires them.
- Validation checks and citations for each consequential change.
「openai-docs」を使用しています。 Why is the OpenAI documentation MCP server unavailable in my local Codex client?
期待される結果:
A focused diagnostic covering supported setup, enabled state, policy, authorization, refresh requirements, and evidence needed before claiming success.
セキュリティ監査
高リスクv1 • 2026/8/17 バージョン別レポートを開く
Most static matches are false positives caused by SVG coordinates, Markdown text, regular-expression calls, or JavaScript template literals. Confirmed behavior includes official network requests, cache writes, environment reads, shell execution, and a curl fallback. Unrestricted sources and cache destinations create SSRF, argument-injection, local-read, and overwrite risks.
16
スキャンされたファイル
2,028
解析済み行数
37
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (3)
高
Unvalidated Manual URL Enables SSRF and Curl Option Injection
The manual URL accepts arbitrary targets and reaches curl without an option terminator, enabling internal requests or curl option injection.
The CLI value is appended directly to curl arguments and no scheme, host, or option-prefix validation occurs.
中
Unrestricted Model Source Reads Local Files or Arbitrary URLs
Environment variables and command arguments can select any local path or HTTP URL, bypassing the skill's official-domain boundary.
The resolver explicitly accepts environment and CLI sources, then reads local files or fetches any HTTP endpoint.
中
scripts/fetch-codex-manual.mjs:286-296scripts/fetch-codex-manual.mjs:394-405scripts/fetch-codex-manual.mjs:511-512
Unrestricted Cache Directory Can Replace Files
A user-selected cache directory receives fixed filenames through rename operations, which can replace existing files in any writable directory.
The override accepts any writable directory and atomically renames fixed cache filenames over existing entries.
機能レビュー項目 (37)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Node.js child_process module
import { execFile } from "node:child_process";
The helper imports child_process and invokes curl through execFile as a network fallback.
中
Proxy environment variable
process.env.HTTP_PROXY ||
The helper reads standard proxy variables and changes its network transport when they are present.
中
Proxy environment variable
process.env.HTTPS_PROXY ||
The helper reads standard proxy variables and changes its network transport when they are present.
中
Proxy environment variable
process.env.http_proxy ||
The helper reads standard proxy variables and changes its network transport when they are present.
中
Proxy environment variable
process.env.https_proxy;
The helper reads standard proxy variables and changes its network transport when they are present.
中
Temp directory access
pushCandidate(`/private/tmp/${DEFAULT_CACHE_DIR_NAME}`);
The helper selects and writes to an operating-system temporary cache directory.
中
Temp directory access
pushCandidate(`/tmp/${DEFAULT_CACHE_DIR_NAME}`);
The helper selects and writes to an operating-system temporary cache directory.
中
Shell command substitution
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
The POSIX wrapper uses command substitution to locate its script directory or Node runtime.
中
Shell command substitution
PATH_NODE=$(command -v node 2>/dev/null || true)
The POSIX wrapper uses command substitution to locate its script directory or Node runtime.
中
Unix shell invocation
#!/bin/sh
The executable wrapper invokes a POSIX shell and then runs a compatible Node runtime.
中
Hidden file access
"$HOME/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node" \
The wrapper checks executable Node binaries under the user's hidden Codex runtime cache.
中
Hidden file access
"$HOME/.cache/codex-runtimes/codex-primary-runtime/dependencies/bin/node" \
The wrapper checks executable Node binaries under the user's hidden Codex runtime cache.
中
Node.js fs operations
return fs.readFile(new URL(source), "utf8");
The resolver reads a local file when its configurable source is not an HTTP URL.
中
Node.js fs operations
return fs.readFile(path.resolve(source), "utf8");
The resolver reads a local file when its configurable source is not an HTTP URL.
低
Hardcoded URL
codex mcp add openaiDeveloperDocs --url https://developers.openai.com/mcp
The source contains an explicit official OpenAI network endpoint.
低
Hardcoded URL
url = "https://developers.openai.com/mcp"
The source contains an explicit official OpenAI network endpoint.
低
Fetch API call
fetch(url, {
The helper performs an HTTP request with the Fetch API.
低
Hardcoded URL
const DEFAULT_MANUAL_URL = "https://developers.openai.com/codex/codex-manual.md";
The source contains an explicit official OpenAI network endpoint.
低
Environment variable access (dot notation)
process.env.HTTP_PROXY ||
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable access (dot notation)
process.env.HTTPS_PROXY ||
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable access (dot notation)
process.env.http_proxy ||
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable access (dot notation)
process.env.https_proxy;
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable access (dot notation)
[process.env.TMPDIR, process.env.TEMP, process.env.TMP].forEach((baseDir) => {
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
process.env.HTTP_PROXY ||
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
process.env.HTTPS_PROXY ||
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
process.env.http_proxy ||
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
process.env.https_proxy;
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
[process.env.TMPDIR, process.env.TEMP, process.env.TMP].forEach((baseDir) => {
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Standard device file access
"$1" -e 'const major = Number(process.versions.node.split(".")[0]); process.exit(major >= 18 ? 0 : 1
The wrapper redirects runtime-probe output to the standard null device.
低
Standard device file access
PATH_NODE=$(command -v node 2>/dev/null || true)
The wrapper redirects runtime-probe output to the standard null device.
低
Fetch API call
const response = await fetch(source, {
The helper performs an HTTP request with the Fetch API.
低
Hardcoded URL
"https://developers.openai.com/api/docs/guides/latest-model.md";
The source contains an explicit official OpenAI network endpoint.
低
Hardcoded URL
const DEFAULT_BASE_URL = "https://developers.openai.com";
The source contains an explicit official OpenAI network endpoint.
低
Environment variable access (dot notation)
source: process.env.LATEST_MODEL_URL || DEFAULT_URL,
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable access (dot notation)
baseUrl: process.env.LATEST_MODEL_BASE_URL || DEFAULT_BASE_URL,
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
source: process.env.LATEST_MODEL_URL || DEFAULT_URL,
The helper reads the named environment variable to choose a proxy, cache location, or model source.
低
Environment variable object
baseUrl: process.env.LATEST_MODEL_BASE_URL || DEFAULT_BASE_URL,
The helper reads the named environment variable to choose a proxy, cache location, or model source.
リスク要因
🌐 ネットワークアクセス (14)
assets/openai-small.svg:2 references/mcp-diagnostics.md:12 references/mcp-diagnostics.md:19 references/upgrading-to-gpt-5p6-sol.md:262 scripts/fetch-codex-manual.mjs:175 scripts/fetch-codex-manual.mjs:19 scripts/fetch-codex-manual.mjs:47 scripts/fetch-codex-manual.mjs:48 scripts/fetch-codex-manual.mjs:49 scripts/fetch-codex-manual.mjs:50 scripts/resolve-latest-model-info.cjs:44 scripts/resolve-latest-model-info.cjs:9 scripts/resolve-latest-model-info.cjs:10 SKILL.md:14
⚙️ 外部コマンド (35)
references/codex-self-knowledge.md:33 scripts/fetch-codex-manual.mjs:12 scripts/fetch-codex-manual.mjs:79 scripts/fetch-codex-manual.mjs:324 scripts/fetch-codex-manual.mjs:82 scripts/fetch-codex-manual.mjs:104-106 scripts/fetch-codex-manual.mjs:161 scripts/fetch-codex-manual.mjs:202 scripts/fetch-codex-manual.mjs:211 scripts/fetch-codex-manual.mjs:219 scripts/fetch-codex-manual.mjs:279 scripts/fetch-codex-manual.mjs:280 scripts/fetch-codex-manual.mjs:318-363 scripts/fetch-codex-manual.mjs:363-369 scripts/fetch-codex-manual.mjs:369-378 scripts/fetch-codex-manual.mjs:378-379 scripts/fetch-codex-manual.mjs:379-396 scripts/fetch-codex-manual.mjs:396-403 scripts/fetch-codex-manual.mjs:403-463 scripts/fetch-codex-manual.mjs:463-472 scripts/fetch-codex-manual.mjs:472-518 scripts/fetch-codex-manual.mjs:518-545 scripts/fetch-codex-manual.mjs:545 scripts/fetch-codex-manual.mjs:548-551 scripts/fetch-codex-manual.mjs:551 scripts/fetch-codex-manual.mjs:572-586 scripts/resolve-latest-model-info:4 scripts/resolve-latest-model-info:23 scripts/resolve-latest-model-info:1 scripts/resolve-latest-model-info.cjs:154 scripts/resolve-latest-model-info.cjs:158 SKILL.md:18 SKILL.md:34 SKILL.md:36 SKILL.md:37
📁 ファイルシステムへのアクセス (18)
references/codex-self-knowledge.md:22 references/codex-self-knowledge.md:24 references/codex-self-knowledge.md:25 references/codex-self-knowledge.md:33 scripts/fetch-codex-manual.mjs:79 scripts/fetch-codex-manual.mjs:318 scripts/fetch-codex-manual.mjs:324 scripts/fetch-codex-manual.mjs:279 scripts/fetch-codex-manual.mjs:280 scripts/fetch-codex-manual.mjs:551 scripts/resolve-latest-model-info:29 scripts/resolve-latest-model-info:30 scripts/resolve-latest-model-info:8 scripts/resolve-latest-model-info:23 scripts/resolve-latest-model-info.cjs:34 scripts/resolve-latest-model-info.cjs:38 scripts/resolve-latest-model-info.cjs:37 scripts/resolve-latest-model-info.cjs:104
🔑 環境変数 (14)
scripts/fetch-codex-manual.mjs:47 scripts/fetch-codex-manual.mjs:48 scripts/fetch-codex-manual.mjs:49 scripts/fetch-codex-manual.mjs:50 scripts/fetch-codex-manual.mjs:272 scripts/fetch-codex-manual.mjs:47 scripts/fetch-codex-manual.mjs:48 scripts/fetch-codex-manual.mjs:49 scripts/fetch-codex-manual.mjs:50 scripts/fetch-codex-manual.mjs:272 scripts/resolve-latest-model-info.cjs:14 scripts/resolve-latest-model-info.cjs:15 scripts/resolve-latest-model-info.cjs:14 scripts/resolve-latest-model-info.cjs:15
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/openai-docs/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/openai-docs?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/openai-docs?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/openai-docs/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/openai-docs.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
openai. (2026). openai-docs security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/openai-docs/audits/1BibTeX形式の引用
@techreport{openai-openai-docs-2026,
author = {openai},
title = {openai-docs security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/openai-docs/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "openai-docs security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/openai-docs/audits/1"
identifiers:
- type: other
value: "skillstore:openai-docs:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 82
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠
作成できるもの
Verify API Behavior
Confirm endpoints, request fields, SDK behavior, and error handling against current official documentation.
Plan a Model Migration
Compare targets and identify model, prompt, tool, state, compatibility, and testing changes.
Configure Codex
Find current guidance for Codex settings, skills, plugins, MCP, automations, setup, and troubleshooting.
これらのプロンプトを試す
Find an Official Answer
Find current official OpenAI documentation for [topic]. Answer [question] concisely and cite the supporting page.
Compare Two Models
Compare [model A] and [model B] for [workload] using current official documentation. Evaluate quality, latency, cost, modalities, and availability.
Plan a Verified Migration
Plan a migration from [current model] to [target model] for [application]. Identify API, prompting, tool, state, compatibility, and testing changes with citations.
Audit an OpenAI Integration
Audit this OpenAI integration against current official documentation: [system description]. Identify unsupported assumptions, schema mismatches, migration risks, and the smallest verified fixes.
ベストプラクティス
- Name the exact product, model, API, or Codex feature in the request.
- Preserve explicitly requested models and state workload constraints before asking for recommendations.
- Use cited official pages for current facts and disclose any bundled fallback.
回避
- Do not ask for current pricing, availability, or limits without requiring official citations.
- Do not treat a search snippet, memory, or bundled snapshot as current documentation.
- Do not request configuration changes when only a documentation answer is needed.
よくある質問
Which sources does this skill use?
It uses official OpenAI developer documentation, platform documentation, ChatGPT Work learning pages, and narrowly selected bundled references.
Can it choose an OpenAI model?
Yes. It compares documented workload fit, quality, latency, cost, modality, and availability while preserving any explicitly requested model.
Can it update my application?
It can guide or implement requested changes after verifying current API and model documentation. API-backed execution may require a separate credential workflow.
Does it know my account limits or access?
No. It states uncertainty when official documentation does not establish account-specific access, quotas, pricing, billing, or rollout status.
What happens when live documentation is unavailable?
It may use a relevant bundled fallback, clearly disclose that choice, and warn that the information may be outdated.
Can it configure the OpenAI documentation MCP server?
Yes, for a supported local Codex client after explicit authorization. It verifies current setup guidance and does not claim success without evidence.