codex-plugin-discovery-8073ad — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex-plugin-discovery-8073ad (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Discover candidate Codex plugins from the official openai/plugins and openai/role-based-plugins GitHub repositories.
Use only metadata indexed from:
https://github.com/openai/plugins
https://github.com/openai/role-based-pluginsThis boundary is intentional, even under deadline or coverage pressure. Do not read Codex .tmp marketplace caches, installed plugin caches, or active-session tool caches. Those sources are out of scope.
Do not auto-install plugins. Recommend candidates and explain the evidence only. Do not claim this covers the full Codex App Plugin Directory.
openai/plugins and openai/role-based-plugins, explain the coverage limit, and ask for the task or category they care about.python3 scripts/list_recent_plugins.py. If the user provides a day count, pass --days N; otherwise use the default 7-day window. If index/plugins-index.json is missing or stale, run python3 scripts/build_index.py first. For mixed requests that ask for both recency and task recommendation, do not combine recency filtering with task recommendation in this first version; answer recent additions first and offer a separate task search.index/plugins-index.json is missing or stale, run python3 scripts/build_index.py.python3 scripts/search_index.py "summarize support tickets".openai/plugins and openai/role-based-plugins.stale means any stored source commit differs from git ls-remote <source repository> HEAD for either configured repository.
Index only direct plugin manifests:
plugins/*/.codex-plugin/plugin.jsonDo not recursively include nested manifests such as plugins/plugin-eval/fixtures/...; valid fixture JSON is still test data, not a recommendable plugin.
For broad availability questions such as "what plugins can I use?", do not dump the full index. Answer with:
openai/plugins and openai/role-based-pluginsFor each recommendation, include:
For recent-plugin results, include:
openai/plugins and openai/role-based-pluginsIf no recent plugins match the requested window, say no additions were found in openai/plugins or openai/role-based-plugins for that period and suggest a wider window.
If no candidate is strong, say no strong match was found in the indexed repositories and suggest manually inspecting openai/plugins and openai/role-based-plugins or broadening the query.
| Temptation | Required Response |
|---|---|
| "Use local caches for broader coverage" | Do not. This skill only indexes openai/plugins and openai/role-based-plugins. |
| "Include fixture manifests for completeness" | Do not. Index only direct plugin manifests. |
| "Auto-install high-confidence matches" | Do not. Recommend and explain only. |
| "Claim this covers the Plugin Directory" | Do not. Say it only covers openai/plugins and openai/role-based-plugins. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.