codex-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Review current code changes by delegating to the codex-reviewer agent.
This skill is precision-first: confidence ≥ 80, "don't flag style/linter-catchable" filter. Optimized for low false-alarm rate on diff review — appropriate default for routine PRs.
For recall-first review on hot-path code (money handling, security paths, spec-implementing code), see the codex-pair sibling — a PostToolUse hook that opts in per-project via a .codex-pair/context.md marker file. The 4-task benchmark in ADR-077 shows codex-pair catches domain-level "wrong but won't crash" issues (float-money precision, cross-cutting validation gaps, edge clamping) that this skill's confidence filter structurally suppresses. Different classes of bug, not the same class with different completeness.
| Use this skill | Use codex-pair |
|---|---|
| Routine PR review (cheap, high precision) | Money/billing/security/spec code (deeper, costlier) |
| You want one comprehensive report | You want every concern flagged with severity |
| Cost-sensitive (~$0.04/PR) | Acceptable cost (~$0.20/edit pass) |
git diff to get unstaged changesgit diff --cached to get staged changescodex-reviewer agent with the diff content. The agent handles the Codex prompt structure and output formatting.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.