codex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code plugin that invokes the local Codex CLI as an independent analysis partner.
Gives Claude Code a structured way to delegate analysis tasks to Codex: brainstorming alternatives, red-teaming plans, debugging from a fresh perspective, reviewing diffs adversarially, and more. Codex runs locally, reads the codebase, and returns its analysis for Claude to synthesise.
Brainstorm, Red-team, Debug, Plan Review, Diff Review, Spec Extraction, Rollout/Rollback, Compare/Decide, Test Gaps, Explain, Post-mortem, Attack Surface, Exhausted Hypotheses.
Codex review catches design-level problems, and its findings can push past a local edit into a plan or direction change. Weakest on subjective style review. What it catches and where it misfires: the agent-tools README.
For code and technical-plan reviews, the skill requires an ownership checklist in every review prompt, including convergence rounds. It asks the reviewer to trace behaviour to its owning component, including dependencies and forks outside the diff, and distinguish legitimate adapter translation from compensation for another component's defect. Findings must name the proper owner and smallest fix there, or identify missing evidence. Explain mode omits this check.
cygpath)After summarising a high-stakes mode (plan-review, red-team, diff-review, exhausted-hypotheses, attack-surface) the skill re-reads its own summary against the fidelity rules before presenting it: every evaluative verb quoted verbatim, no explanatory bridge the source does not contain, inline citations counted in prose as well as bullets.
Via the agent-tools marketplace:
/plugin marketplace add koenvdheide/agent-tools
/plugin install codex@agent-tools
/reload-pluginsRefresh later with /plugin marketplace update agent-tools, then /plugin update codex@agent-tools and /reload-plugins.
Claude invokes the skill automatically when a task matches, or you can invoke it directly:
/codex:codex red-team my authentication refactor planCodex can run in a convergence loop for artifacts that evolve across multiple revisions (specs, plans, designs): review → fix → re-review until the reviewer gives an affirmative verdict, you stop, or drift appears. Claude orchestrates the loop with user gates after each round, and cites prior findings on each pass so the reviewer can detect drift. It also watches for the scope-drift failure mode, where each round's "real" findings pull the artifact into a design the user never asked for.
A round asks you for two decisions: which fixes to apply, then whether to continue. See the Convergence Mode section in skills/codex/SKILL.md for the loop shape, per-round prompt construction, and the anti-pattern guidance on when Claude should stop and re-confirm scope.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.