sync-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sync-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Synchronize skills between Claude Code and Codex so both runtimes share the same skill library.
Read .marketing-os.yml in the repo root. The primary_runtime field (claude or codex) determines sync direction:
.claude/skills/ → .agents/skills/.agents/skills/ → .claude/skills/If .marketing-os.yml doesn't exist or has no primary_runtime, default to claude.
Set SRC and DST based on the primary:
CONFIG=".marketing-os.yml"
PRIMARY="claude"
if [ -f "$CONFIG" ]; then
PRIMARY=$(grep 'primary_runtime:' "$CONFIG" | awk '{print $2}' | tr -d '"'"'" || echo "claude")
fi
if [ "$PRIMARY" = "codex" ]; then
SRC=".agents/skills"
DST=".claude/skills"
else
SRC=".claude/skills"
DST=".agents/skills"
fiAsk the user which sync to run:
$SRC/ → $DST/ in the current repo using hardlinksIf invoked from /start, default to Project without prompting.
Hardlinks keep both paths pointing to the same file on disk, so edits in either location are instant. New or renamed skills need a re-sync.
mkdir -p "$DST"
# Add/update: link any file in SRC that's missing or has a different inode in DST
# Exclude sync-skills itself — it's runtime-specific, not useful in the secondary
cd "$SRC"
find . -type f -not -path './sync-skills/*' -not -path './setup/*' | while read -r f; do
dst_file="$DST/$f"
if [ ! -f "$dst_file" ] || [ "$(stat -f %i "$SRC/$f")" != "$(stat -f %i "$dst_file")" ]; then
mkdir -p "$(dirname "$dst_file")"
rm -f "$dst_file"
ln "$SRC/$f" "$dst_file"
fi
done
# Remove: delete anything in DST that no longer exists in SRC
cd "$DST"
find . -type f | while read -r f; do
[ ! -f "$SRC/$f" ] && rm -f "$DST/$f"
done
# Clean up empty directories
find "$DST" -type d -empty -delete 2>/dev/nullReport what was added (+) or removed (-). If nothing changed, say so in one line.
Copies skills between user-level directories. Direction follows the same primary logic:
~/.claude/skills/ → ~/.codex/skills/~/.codex/skills/ → ~/.claude/skills/Uses a .synced-from-primary marker file inside each synced skill directory to track provenance.
if [ "$PRIMARY" = "codex" ]; then
SRC_USER="$HOME/.codex/skills"
DST_USER="$HOME/.claude/skills"
MARKER=".synced-from-codex"
else
SRC_USER="$HOME/.claude/skills"
DST_USER="$HOME/.codex/skills"
MARKER=".synced-from-claude"
fi
mkdir -p "$DST_USER"
for skill_dir in "$SRC_USER"/*/; do
[ -f "${skill_dir}SKILL.md" ] || continue
skill_name=$(basename "$skill_dir")
case "$skill_name" in .*) continue ;; esac
[ -L "${skill_dir}SKILL.md" ] && continue
target="$DST_USER/$skill_name"
# If target exists without marker, it's a manual skill in the secondary runtime — don't overwrite
if [ -d "$target" ] && [ ! -f "$target/$MARKER" ]; then
echo "SKIP: $skill_name (manual skill in secondary runtime)"
continue
fi
rm -rf "$target"
cp -r "${skill_dir%/}" "$target"
echo "$skill_dir" > "$target/$MARKER"
echo "SYNC: $skill_name"
done
# Report orphans
for target in "$DST_USER"/*/; do
[ -f "${target}$MARKER" ] || continue
skill_name=$(basename "$target")
[ ! -d "$SRC_USER/$skill_name" ] && echo "ORPHAN: $skill_name (source removed from primary)"
doneReport what was synced, skipped (manual), and any orphans. Do NOT auto-delete orphans — flag them and let the user decide.
After syncing skills, also sync the root instruction files if either has changed:
CLAUDE.md is newer than AGENTS.md, regenerate AGENTS.md from it (swap title, swap .claude/ → .agents/ path references)AGENTS.md is newer than CLAUDE.md, regenerate CLAUDE.md from it (swap title, swap .agents/ → .claude/ path references)Title swap: replace the first line's "Claude Instructions" with "Codex Instructions" or vice versa.
Path swaps:
/.claude/skills/ ↔ /.agents/skills//.claude/agents/ ↔ /.agents/agents/Show a short summary:
## Skills Sync Complete
Primary runtime: [claude|codex]
### Project ($SRC → $DST)
[X added, Y removed, Z unchanged]
### User ($SRC_USER → $DST_USER) (if run)
[X synced, Y skipped (manual), Z orphans]
### Instruction files
[AGENTS.md regenerated from CLAUDE.md | No changes needed]sync-skills or setup skills themselves — they belong to the primary runtime only.marketing-os.yml~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.