new-skill-4272d4 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited new-skill-4272d4 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a one-line intent into the correct Codex extension artifact. Choose the artifact type first; the wrong type is the easiest way to create brittle automation.
$skill-name. Use for context-rich workflows that benefit from model judgment.
.codex/agents/ for project scope or ~/.codex/agents/ for personal scope. Use for isolated, repeatable subagent work.
formatting, or guardrails that should not depend on model memory.
marketplace-backed sharing. Use when the user wants an installable bundle.
${CODEX_HOME:-~/.codex}/skills/<name>/SKILL.md..agents/skills/<name>/SKILL.md or a plugin-provided skill, whenthe repo should carry it.
.codex/agents/<name>.toml.${CODEX_HOME:-~/.codex}/agents/<name>.toml..codex-plugin/plugin.json and optional skills/,hooks, scripts, assets, MCP, or apps.
Default to project placement when the artifact depends on repo paths, commands, or conventions. Use personal/global placement only for genuinely project-agnostic skills.
Use the user's one-line description. If essential information is missing, ask only the smallest number of questions needed: what it does, when it should trigger, and whether it is personal or repo-scoped.
Decide skill, custom agent, hook, or plugin. State the reason in one line before writing. If the user asked for "every time", "before", "after", or "always", bias toward a hook. If they asked for "share/install/package", bias toward a plugin.
For a skill:
SKILL.md with only name and description frontmatter unless Codex docs forthe target explicitly allow more.
description trigger-rich: what it does plus concrete user phrases and contexts.agents/openai.yaml only when UI metadata is useful.For a custom agent:
name, description, and developer instructions in the Codex customagent format used by the target installation.
For a hook:
For a plugin:
.codex-plugin/plugin.json.name.Report what was created and where. Remind the user that new Codex skills and agents are picked up in a new session.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.