codex-skills-kit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex-skills-kit (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A reliability toolkit for serious OpenAI Codex work, shipped as a plugin and portable [Agent Skills](https://developers.openai.com/codex/skills).
Most prompt libraries stop at prompt. Real agent failures happen later: wrong worktree, shared index contamination, checks that never caught anything, build results presented as runtime proof, and finished sessions stranded on one disk.
This kit packages a production-tested operating loop for Codex:
prompt → isolate → execute → gate → verify → close → distill ↺Each workflow lives in focused SKILL.md, loads through progressive disclosure, and carries only rules another Codex run needs to do work.
| Skill | Job | Trigger example |
|---|---|---|
| [codex-prompt](./skills/codex-prompt/) | Generate grounded delegation prompts across six task types | "Write a Codex fix prompt" |
| [git-under-contention](./skills/git-under-contention/) | Preserve work when agents share branches, indexes, or worktrees | "Commit without touching other sessions" |
| [gate-engineering](./skills/gate-engineering/) | Build durable checks with seeded red and green proof | "Add a gate for this defect class" |
| [verify-honestly](./skills/verify-honestly/) | Match completion claims to execution-context evidence | "Is this actually fixed?" |
| [session-close](./skills/session-close/) | Reconcile, verify, preserve, and hand off session state | "Close out this session" |
| [retro-distill](./skills/retro-distill/) | Turn observed successes and failures into reusable rules | "What did we learn?" |
Together they cover work before, during, and after code generation.
codex-prompt task contract is checked into task-types.json. It maps every supported type to skill section, prompt template, worked example, and golden fixture under fixtures/golden-prompts/. CI catches drift between methodology and prompts users copy.
v0.2 introduced task registry and golden prompt fixtures. v0.3 adds four reliability layers distilled from sustained production work:
Project names, private infrastructure, and domain-specific rules were removed. Methods remain.
Recommended path bundles all six skills:
codex plugin marketplace add TAKEOFF69/codex-skills-kitOpen /plugins, switch to Codex Skills Kit marketplace, install Codex Skills Kit, and start a new thread so Codex loads updated bundle.
For local clone:
codex plugin marketplace add ./path/to/codex-skills-kitInstall any skill directly from GitHub tree URL:
$skill-installer install https://github.com/TAKEOFF69/codex-skills-kit/tree/main/skills/codex-prompt
$skill-installer install https://github.com/TAKEOFF69/codex-skills-kit/tree/main/skills/git-under-contention
$skill-installer install https://github.com/TAKEOFF69/codex-skills-kit/tree/main/skills/gate-engineering
$skill-installer install https://github.com/TAKEOFF69/codex-skills-kit/tree/main/skills/verify-honestly
$skill-installer install https://github.com/TAKEOFF69/codex-skills-kit/tree/main/skills/session-close
$skill-installer install https://github.com/TAKEOFF69/codex-skills-kit/tree/main/skills/retro-distillOr clone and copy selected folders into supported scope:
./.agents/skills/$HOME/.agents/skills/$CODEX_HOME/skills, normally $HOME/.codex/skillsgit clone https://github.com/TAKEOFF69/codex-skills-kit
cp -r codex-skills-kit/skills/verify-honestly .agents/skills/Trigger skills implicitly with matching request or explicitly with $skill-name.
Every delegated task starts with:
Goal: <what changes>
Success means: <observable criteria>
Stop when: <completion or safe stop condition>Then it adds context, constraints, assumptions, invariant, risk gate, repository mismatch handling, and exact done-when evidence.
Parallel agents cannot treat checkout as private workspace. git-under-contention detects deterministic contention signals and enforces explicit ownership:
python skills/git-under-contention/scripts/contention_preflight.py --selftest
python skills/git-under-contention/scripts/contention_preflight.py --mine skills/my-skillgate-engineering separates ordinary feature tests from standing repository gates:
seeded defect → observed red → fixed twin → observed green → corpus runIt also checks empty-set traps, mutable snapshots, read-path bypasses, and stale baselines.
verify-honestly uses five named levels:
code read → local tests → browser pass → live data check → production smokeHighest applicable level is reported per shipped item with anything still deploy-gated or inaccessible.
session-close reconciles state, documentation, generated artifacts, verification, commits, pushes, and handoff. retro-distill promotes supported lessons into right active surface: prompt skill, workflow skill, executable gate, AGENTS.md, or project memory.
| Fix | Build | Ops/Tuning | Audit | Refactor | PR-series |
|---|---|---|---|---|---|
| mandatory diagnosis before patch | feature from spec | live baseline and before/after evidence | read-only verdict | inventory before structure change | ordered, dependency-aware PRs |
See examples/ for full prompts on fictional Acme Notes project.
codex-skills-kit/
├── .codex-plugin/plugin.json
├── .agents/plugins/marketplace.json
├── AGENTS.md
├── skills/
│ ├── codex-prompt/
│ ├── gate-engineering/
│ ├── git-under-contention/
│ ├── retro-distill/
│ ├── session-close/
│ └── verify-honestly/
├── examples/
├── fixtures/golden-prompts/
├── task-types.json
├── scripts/validate_skills.py
├── CHANGELOG.md
└── .github/workflows/validate-skills.ymlpython scripts/validate_skills.py --selftest
python scripts/validate_skills.py
python skills/git-under-contention/scripts/contention_preflight.py --selftestContributions should prevent observed failure classes, remain project-neutral, and keep skill bodies concise. Validator covers skills, plugin metadata, task registry, golden fixtures, release metadata, links, and secret patterns. See CONTRIBUTING.md and AGENTS.md.
Use it, fork it, and adapt it to your stack. Attribution appreciated.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.