ask-codex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ask-codex (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use the local Codex CLI as an external worker or advisor from inside a Claude Code session. Hand off a focused task, collect the output, and save a reviewable Markdown artifact before acting on the result.
codex CLI is missing or unauthenticated.codex CLI available in PATH and authenticated.codex --versionIf codex is missing, stop and ask the user to install it. Installation reference:
npm install -g @openai/codex.apx/artifacts/).codex --versionIf this fails, stop. Do not proceed without codex in PATH.
Keep it narrow. Codex works best with:
Example prompt:
Review this TypeScript function for correctness. Return a bullet list of issues found.
<paste function here>codex "Review this TypeScript function for correctness. Return a bullet list of issues found.\n\n$(cat src/cli/commands/validate.ts)"Redirect output to an artifact file:
codex "Your prompt here" > .apx/artifacts/codex-review-$(date -u +%Y%m%dT%H%M%SZ).mdOn Windows (PowerShell):
codex "Your prompt here" | Out-File .apx/artifacts/codex-review-$(Get-Date -Format 'yyyyMMddTHHmmssZ').mdOpen the artifact before acting on any recommendation. Codex output is a suggestion, not a directive. Apply judgment before implementing.
In the response to the user, include:
Artifact path convention:
.apx/artifacts/codex-<slug>-<timestamp>.mdArtifact should contain:
codex, do not improvise.codex --version and reauthenticate.apx check ask-codex verifies whether codex is present in PATH.
Prefer the flat APX command after reading this skill:
apx ask-codex "Review this function for edge cases"
apx ask-codex "Return OK only" --jsonNested APX form remains supported:
apx ask codex "Review this function for edge cases"APX passes the prompt as a positional argument (codex "prompt", not codex -p "prompt"). This matches the Codex CLI's invocation convention. Verify the output mode with codex --help if the captured stdout is empty — some Codex versions open a TUI by default and may require a flag such as --full-auto or -q for non-interactive output. If that applies, invoke codex directly per the workflow above and redirect output manually.
apx check ask-codex
apx ask-codex "Return OK only" --jsonConfirm JSON includes provider, artifactPath, promptLength, and raw output in stdout. Open the artifact before applying advice.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.