codex-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex-agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill enables Claude Code to collaborate with OpenAI's Codex CLI agent for second-opinion review, cross-verification, debugging analysis, and alternative implementation proposals.
Default posture: Codex reviews in read-only; the primary agent applies changes only when the user asked for fixes or approved them after reading the review.
Use this workflow when the user asks for Codex review, wants a second opinion, or needs cross-verification from a separate coding agent.
REPORT="$(mktemp -t codex-review.XXXXXX.md)"
codex exec -C <project_path> -s read-only -o "$REPORT" \
"Review the code in <file_or_directory>. Check for:
- Security vulnerabilities
- Performance issues
- Code quality and best practices
- Potential bugs and edge cases
- Naming and readability
Provide specific, actionable feedback with file paths and line numbers."
cat "$REPORT"Keep the write and read in the same Bash call, or pass a concrete report path between calls; shell variables do not persist across tool calls.
When the user asked to apply fixes, handle each issue identified by Codex:
If the user only asked for a review or second opinion, report findings without editing files.
codex exec -C <project_path> -s read-only \
"Verify the fixes applied to <files>. Confirm issues are resolved."# Step 1: Get Codex review
REPORT="$(mktemp -t codex-review.XXXXXX.md)"
codex exec -C /project -s read-only -o "$REPORT" \
"Review src/auth/login.ts for security vulnerabilities and code quality issues. Provide specific line numbers and fixes."
# Step 2: Read the feedback
cat "$REPORT"Then the primary agent reads the feedback, applies fixes with Edit tool, and optionally re-verifies.
# Get diff of recent changes
DIFF_REPORT="$(mktemp -t recent-changes.XXXXXX.diff)"
git diff HEAD~1 > "$DIFF_REPORT"
# Step 1: Have Codex review the diff
REPORT="$(mktemp -t codex-review.XXXXXX.md)"
codex exec -C /project -s read-only -o "$REPORT" \
"Review the changes saved at $DIFF_REPORT. Check for bugs, security issues, and improvements needed."
# Step 2: Read and apply fixes
cat "$REPORT"# Step 1: Comprehensive review
REPORT="$(mktemp -t codex-review.XXXXXX.md)"
codex exec -C /project -s read-only -o "$REPORT" \
"Perform a comprehensive code review of src/. Focus on:
1. Security vulnerabilities (OWASP Top 10)
2. Error handling patterns
3. Performance bottlenecks
4. Code duplication
Prioritize issues by severity (critical/high/medium/low)."
# Step 2: Read prioritized feedback
cat "$REPORT"When asking Codex for review, include:
Review <target_files_or_directory>.
Context:
- Project type: <TypeScript/Python/etc>
- Framework: <Express/React/etc>
- Focus areas: <security/performance/quality>
Check for:
1. Security vulnerabilities
2. Performance issues
3. Error handling
4. Code quality
5. Edge cases
Output format:
For each issue:
- File: <path>
- Line: <number>
- Severity: critical/high/medium/low
- Issue: <description>
- Fix: <specific code change>After receiving Codex feedback, apply fixes systematically:
Codex CLI must be installed and authenticated:
# Install via npm
npm install -g @openai/codex
# Or via Homebrew (macOS)
brew install --cask codex
# Authenticate
codex logincodex exec [options] "<task_description>"| Option | Description |
|---|---|
"<task>" | Task description (positional, must be quoted) |
-C <dir> | Working directory (use absolute path) |
-s read-only | Read-only sandbox (use for reviews) |
-o <path> | Save output to file |
--json | Output as JSON Lines |
When communicating with Codex, PRIORITIZE ACCURACY AND PRECISION:
codex exec -C /project -s read-only \
"Verify the implementation in src/feature/. Check correctness and edge cases."REPORT="$(mktemp -t codex-alternative.XXXXXX.md)"
codex exec -C /project -s read-only -o "$REPORT" \
"Propose an alternative implementation for the caching in src/cache/manager.ts"
cat "$REPORT"codex exec -C /project -s read-only \
"Debug: tests in tests/auth.test.ts failing with timeout. Analyze root cause."For multi-turn reviews:
# Initial review
codex exec -C /project -s read-only "Review src/api/ for security issues"
# Note session ID from output
# Follow-up after fixes
codex exec resume <session_id> "I've applied the fixes. Please re-verify."scripts/check-codex.sh checks whether the Codex CLI is installed and authenticated.scripts/codex-wrapper.sh is optional. Use it only when you need a small CLI wrapper; it executes Codex through shell arrays and must not use eval./tmp/codex-review.md; use mktemp or a project-specific private report path so concurrent projects cannot overwrite or read stale feedback.read-only unless the user explicitly asked Codex itself to edit.danger-full-access, --dangerously-bypass-approvals-and-sandbox, --dangerously-bypass-hook-trust, and --skip-git-repo-check as high-impact flags. Ask before using them.codex logout
codex logincodex --version
which codex~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.