Is codex-pair-resume safe to install?

SaferSkills independently audited codex-pair-resume (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

packages/claude-plugin/skills/codex-pair-resume/SKILL.md · 1 file

packages/claude-plugin/skills/codex-pair-resume/SKILL.md1.7 KB · Markdown

name: codex-pair-resume

description: Resume the codex-pair PostToolUse hook for this project after a previous /codex-pair-pause. Removes the .codex-pair/state/paused sentinel. The hook starts reviewing edits again on the next Edit/Write/MultiEdit. No-op if no pause sentinel exists.

user_invocable: true

Resume codex-pair for this project

Removes the pause sentinel written by /codex-pair-pause, restoring normal codex-pair review behavior. The .codex-pair/context.md marker and .codex-pair/state/ directory are left in place (the directory holds the cache, inflight locks, and any other future state per ADR-092).

Instructions

Locate the .codex-pair/context.md marker by walking up from the current working directory (the project ROOT is the directory holding .codex-pair/). If no marker is found, inform the user: "codex-pair is not enabled in this project (no .codex-pair/context.md marker found). Nothing to resume."

Check whether the pause sentinel exists at <marker-dir>/.codex-pair/state/paused:

If it does not exist, tell the user: "codex-pair was not paused — no .codex-pair/state/paused sentinel found. No change."
If it exists and is non-empty, it is an auto-pause written by the hook itself

(quota exhaustion or repeated failures — see #176). cat it and show the user the kind, reason, and resetHint fields before removing, so they know whether the provider has likely recovered.

Remove it:

     rm <marker-dir>/.codex-pair/state/paused

Confirm to the user with the marker directory path:

   codex-pair resumed for <marker-dir>
   The next Edit/Write/MultiEdit will trigger a review.

codex-pair-resume— agent skill

Is codex-pair-resume safe to install?

Resume codex-pair for this project

Instructions

Audit the pieces. Scan the whole. Decide.