deep-researcher — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deep-researcher (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a task needs defensible, current, multi-source research: library/API decisions, dependency investigations, release or changelog analysis, GitHub issue/source archaeology, agent-prompt research, standards checks, or high-stakes citations.
Use a dual-plane design:
web.search_query, web.open, web.find, GitHubapp tools, Context7 MCP when explicitly useful, Exa MCP, and $opensrc from the session. These tools are available to Codex, not to the Rust CLI.
codex-research for provider routing, Context7 REST API,GitHub REST/gh fallback, Firecrawl calls, direct fetch probes, SQLite/CAS cache state, JSONL ledgers, Markdown reports, doctor output, and evals.
Always treat search results as leads until hydrated into source records. A claim is not ready to rely on until it is tied to source IDs, source freshness, and a confidence score.
Default order for broad research:
confirmation.
codex-research context7 for version-awarelibrary/API docs.
codex-research github for repository, code, issue, PR,release, tag, compare, manifest, and changelog evidence.
codex-research fetch probe|get for text/static pages.exploration, and source expansion when native web is too narrow.
agent-browser or Firecrawl only when route prediction says direct fetch islikely an app shell, blocked, rendered, or crawl-heavy page.
$opensrc when package implementation source is required.Use codex-research plan "<query>" --profile quick|standard|deep|exhaustive to inspect call budgets before broad research. For replayable runs, initialize run state and pass --run to provider commands:
codex-research run init "<query>" --profile deep --topic github --out .codex/research/run.json
codex-research run status --run .codex/research/run.jsonNative Codex web calls are not visible to the CLI. Debit them manually with codex-research run debit --run .codex/research/run.json --provider codex-web when they are part of the same budgeted run.
Firecrawl is a paid-capacity fallback lane, not the first source.
--fresh so maxAge=0.--no-store-in-cache.the user explicitly allows external scraping for that material.
fetch, prefer that before Firecrawl.
Use hybrid GitHub access:
threads, workflow logs, and authenticated repository metadata.
codex-research github for standalone, replayable, and reportable RESTcalls. It falls back through GITHUB_TOKEN, GH_TOKEN, gh auth token, then public unauthenticated mode.
rate limits, then fetch full files, issue threads, releases, or compare ranges before citing.
rg only when API search cannotprove the source-level claim.
When using subagents, follow $subspawn strict rendezvous behavior. The main Codex session spawns specialized research subagents, immediately waits for all spawned agents in the batch, then synthesizes. Research subagents must not spawn nested subagents.
Initial focused pack:
deep_researcher: lead multi-source researcher and synthesis owner.github_researcher: GitHub repository/code/issues/releases specialist.context7_researcher: direct Context7 API docs specialist.openai_docs_researcher: official OpenAI docs specialist.source_validator: package/source/release implementation validator.citation_auditor: claim-to-source and freshness auditor.Install templates with:
python3 skills/deep-researcher/scripts/install_agents.py --target project
python3 skills/deep-researcher/scripts/install_agents.py --target globalFor meaningful research, produce both machine and human outputs:
.codex/research/ledger.jsonlUseful commands:
codex-research doctor
codex-research cache init
codex-research plan "research question" --profile deep
codex-research run init "research question" --profile deep --topic general --out .codex/research/run.json
codex-research fetch probe "https://example.com/docs"
codex-research context7 search --library "Next.js" --query "middleware auth"
codex-research github search-code 'repo:owner/repo symbol in:file'
codex-research ledger init
codex-research ledger add-source --from-cache <source-id>
codex-research report --ledger .codex/research/ledger.jsonl
codex-research evalStop and mark UNVERIFIED when:
explicit permission;
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.