codexa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codexa (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a task involves understanding, editing, reviewing, or verifying a repository that has Codexa installed or available through the Codexa MCP server.
.codex/config.toml, use the project-local Codexa MCP server. If the MCP server is unavailable, run the equivalent codexa CLI command from the repository.session_context -> search(if target unclear) -> task_brief -> change_plan(saveSnapshot) -> post_edit_review -> test_plan.session_context first. If the target is unclear or actionability says needs_target, raw_search_better, or raw_search_sufficient, use first-class search or ask for an explicit target before planning edits.search first when the target is unclear; otherwise call task_brief before reading or editing source.symbol_context or impact when you need callers, callees, implementations, tests, risks, edge evidence, or the next exact Codexa tool.change_plan with saveSnapshot=true so Codexa can compare the plan with the final dirty tree and planned-test provenance.post_edit_review before the final response and pass any commands or test reports that were actually run. Treat degraded snapshot tests as evidence to inspect or rerun, not as trusted coverage. MCP post_edit_review is review-only; AutoVerify execution is limited to the Codexa hook path when the user environment enables it.workflow_path, callers, callees, or dependency_path before editing shared surfaces.test_plan when the verification surface is unclear..codex/ cache artifacts, but there must be no source-mutating MCP tool path.Use these commands from the target repository when MCP is not available:
codexa session-context .
codexa search . --query "<task, literal, or symbol>"
codexa brief . --task "<task>"
codexa explain . --symbol "<symbol_or_stable_id>"
codexa impact . --symbol "<symbol_or_stable_id>"
codexa change-plan . --task "<task>" --save-snapshot --task-id "<task_id>"
codexa post-edit-review . --task-id "<task_id>" --ran-command "<command>"
codexa test-plan .
codexa serve . --transport http --host 127.0.0.1 --port 8729Prefer --task-id for post-edit-review so Codexa can compare against the saved snapshot. Use post-edit-review . --task "<task>" ... only when no snapshot exists.
Use --no-auto-refresh only when the host requires strict filesystem-read-only metadata. The default auto-refresh mode may update generated Codexa cache artifacts under .codex/, but it does not mutate source files.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.