fix: require explicit requests for security fix verification

[kmbroai]

Summary

The verify-fix skill can be selected for ordinary fix requests and impose its JSON result format. Restrict its trigger to explicit requests to verify that a security fix remediates a reported vulnerability.

Changes

• Narrow the skill description to exclude automatic invocation during implementation, ordinary code review, and test runs.
• Clarify that other tasks retain the user's requested workflow and response format.

Testing

• Ruff 0.16.1 check and format check: passed for the plugin and portable source-check scripts (run through uv run --no-project --with ruff==0.16.1 because the default Python environment lacks Ruff).
• python .github/scripts/check_plugin_source_compatibility.py: passed.
• Skill creator quick_validate.py for verify-fix: passed.
• git diff --check: passed.
• Reviewed the trigger wording against implementation-only, test-only, non-security review, and explicit security-fix verification requests. Live model routing was not tested.

Risk and rollout

Instruction-only change. The verification workflow, read-only boundary, and JSON result contract remain unchanged when the skill is requested. No CLI surface changes. Skill selection still depends on the model following the description and instructions.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-05T21:46:04.411632Z	6f680e0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.