geo-pipeline — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited geo-pipeline (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
On Claude Code each stage is a bare slash command (/01-intake … /07-reaudit). Codex CLI has no bare custom commands, so this skill is the Codex entry point: it carries the orchestration rules and routes to the per-stage specification files, which are the single source of truth shared with the Claude Code side. Do not duplicate stage logic here — read the stage file and follow it.
Per-stage specs (read the one you're running): commands/01-intake.md, commands/02-audit.md, commands/03-gap.md, commands/04-content-brief.md, commands/05-production.md, commands/06-distribution.md, commands/07-reaudit.md (relative to this plugin's root). Full directory convention + dependency graph: orchestrator/run.md.
clients/<slug>/ and the stage the user wants.commands/0X-*.md and execute its Procedure verbatim.moving on (Codex has no built-in schema validation — run it explicitly):
python3 - <<'PY'
import json, jsonschema
pairs = {
"brand_context.json": "brand_context.schema.json",
"visibility_baseline.json": "visibility_baseline.schema.json",
"content_priorities.json": "content_priorities.schema.json",
} # see schemas/ for the full set incl. attribution_diff + review_feedback
# jsonschema.Draft202012Validator(json.load(open("plugins/recomby-geo/schemas/<file>"))).validate(json.load(open("clients/<slug>/<artifact>")))
print("validate each artifact against plugins/recomby-geo/schemas/*.schema.json")
PYinputs/ → 01-intake → brand_context.json
→ 02-audit → visibility_baseline.json
→ 03-gap → content_priorities.json
→ 04-content-brief → briefs/<id>.md (+ .html, REQUIRED-FILL slots)
[EXPERT FILLS THE SLOTS — not the AI]
04 Step 9 verifies fills → status: ready-for-production
→ 05-production → drafts/<id>.md (+ review .html)
→ 06-distribution → distribution/<id>.json + publish-bundle.md
[PUBLISH + WAIT 7+ days]
→ 07-reaudit (monthly) → reaudit/round-N.json → feeds next 03-gap02 needs 01; 03 needs 01+02; 04 needs 01+03; 05 needs 04 (filled); 06 needs 05; 07 needs a prior 02.
05-production refuses to rununless briefs/<id>.meta.json status is ready-for-production. Never auto-fill REQUIRED-FILL slots; pause the pipeline if the expert is unavailable. This human-in-loop checkpoint is the entire moat.
before moving on. Schemas: schemas/*.schema.json.
clients/<slug>/folders or factor out "common" context.
Stages 04 and 05 produce interactive HTML for the client via the geo-review-html skill (also in this plugin). On Codex this works the same as on Claude Code — the stage spec already calls render_html.py.
The capability skills' scripts (e.g. seo-geo-optimizer, geo-review-html) need python3 on PATH; the schema validation step needs jsonschema (pip install jsonschema). These are the same dependencies as the Claude Code side.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.