port-project-codex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited port-project-codex (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Finds project-local Claude Code skills and agents that have no Codex counterpart, adapts approved items to Codex conventions, and writes only to the current project's project-local Codex directories.
Source: .claude/skills/ and .claude/agents/ inside the current working directory. Target: .agents/skills/ and .codex/agents/ inside the current working directory. Never touches global ~/.codex/ or modifies any .claude/ file.
Run both diffs:
# Skills missing from .agents/
comm -23 \
<(ls .claude/skills/ 2>/dev/null | sort) \
<(ls .agents/skills/ 2>/dev/null | sort)
# Agents missing from .codex/ (strip .md extension)
comm -23 \
<(ls .claude/agents/ 2>/dev/null | sed 's/\.md$//' | sort) \
<(ls .codex/agents/ 2>/dev/null | sed 's/\.toml$//' | sort)If both lists are empty, report "No gaps found - project .claude/, .agents/, and .codex/ are in sync." and stop.
Show the user two sections:
Skills to port (.claude/skills/<name>/SKILL.md -> .agents/skills/<name>/SKILL.md)
- <name>
...
Agents to port (.claude/agents/<name>.md -> .codex/agents/<name>.toml)
- <name>
...Ask which items to port. Require explicit per-item approval before any write.
For each approved skill, read .claude/skills/<name>/SKILL.md, then apply these substitutions:
| Find | Replace |
|---|---|
CLAUDE.md | AGENTS.md |
/<skill-name> invocation syntax | $<skill-name> |
where-claude cross-references | where-agents-md |
audit-claude-md cross-references | audit-agent-docs |
Personal Claude config paths (~/.claude/) | Personal Codex config paths (${CODEX_HOME:-~/.codex}/) |
Project Claude skill paths (.claude/skills/) | Project Codex skill paths (.agents/skills/) |
Project Claude agent paths (.claude/agents/) | Project Codex agent paths (.codex/agents/) |
| "Claude Code" when referring to the product | "Codex" |
| "CLAUDE.md" as a generic concept for instruction files | "AGENTS.md" |
Note cross-references that differ between products, especially where-claude vs where-agents-md and audit-claude-md vs audit-agent-docs; do not silently rename them without calling out the change.
Show the adapted content to the user and require approval before writing to .agents/skills/<name>/SKILL.md. Create .agents/skills/<name>/ as needed only after approval and only if the target file does not already exist.
For each approved agent, read .claude/agents/<name>.md. This is a lossy Markdown-to-TOML conversion. Flag that explicitly and require human review before writing.
Extract from frontmatter and body:
name: -> TOML name, converting hyphens to underscores for TOML conventiondescription: -> TOML descriptiondeveloper_instructionstools: list with only Read, Glob, and Grep -> sandbox_mode = "read-only"model: haiku -> model_reasoning_effort = "medium"model -> omit model settings and use the Codex defaultApply the same Claude-to-Codex product reference fixes from step 3 to developer_instructions.
Write .codex/agents/<name>.toml in this shape:
name = "<underscore_name>"
description = "<description from frontmatter>"
developer_instructions = """
<body content, with Claude→Codex product references fixed>
"""
sandbox_mode = "read-only"If the Claude agent declares tools beyond Read, Glob, and Grep, stop for that item and ask the user how to represent the permissions in Codex. Do not guess a broader sandbox mode.
Report:
$commands to appear.agents/skills/ or .codex/agents/; skip with a per-item warning..claude/; it is a read-only source.~/.codex/; write only to project-local .agents/skills/ and .codex/agents/.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.