stympy/codex-review
codex-review/SKILL.md
Code review: read diffs, run checks, report findings.
$ install --global
skillsauthnpx skillsauth add stympy/skills codex-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 3:15 AM16.6s1 file scanned
SKILL.md
- name:
- codex-review
- description:
- Code review: read diffs, run checks, report findings.
- argument-hint:
- [scope]
- allowed-tools:
- Bash(codex *), Bash(git *), Bash(npx tsc*), Bash(npx eslint*), Read, Grep, Glob
Code Review
Review $ARGUMENTS.
Read the diffs. Run the checks. Report what's broken. One pass.
Step 1: Determine scope
- Empty or "all" →
git diff+git diff --cached - File path → review that file
- "branch" →
git diff main...HEAD - "commit" →
git show HEAD
Read the code first. Understand intent before judging.
Step 2: Read (5 perspectives)
Assume the code is broken until proven otherwise.
- Security — injection, auth bypass, timing attacks, secrets in code, XSS, CSRF
- Correctness — logic errors, off-by-one, null/undefined, wrong types, unreachable code
- Compliance — data handling, consent flows, logging gaps, retention violations
- Performance — unnecessary loops, missing caching, unbounded payloads, N+1 queries
- Maintainability — dead code, unclear naming, missing error handling, unused imports
Step 3: Run checks
Run these on the changed files and report failures only:
npx tsc --noEmit 2>&1 | head -50
npx eslint --no-warn . 2>&1 | head -50
Also check:
grep -r 'TODO\|FIXME\|HACK\|XXX'in changed files- Hardcoded secrets: API keys, tokens, passwords in source
If you have Codex CLI available, you can run checks in its sandbox:
codex exec -s read-only "npx tsc --noEmit && npx eslint --no-warn ."
This is optional. Direct execution works fine for trusted repos.
Step 4: Merge findings
Combine reading findings with check output. Deduplicate — keep the more specific version.
- CRITICAL / HIGH → fix immediately
- MEDIUM → note in report
- LOW → skip unless trivial
Step 5: Output
## Code Review Results
### Findings
| # | Perspective | Severity | File | Issue | Action |
|---|-------------|----------|------|-------|--------|
| 1 | Security | CRITICAL | ... | ... | Fixed |
| 2 | Correctness | HIGH | ... | tsc: Type 'X' not assignable... | Fixed |
| 3 | Compliance | MEDIUM | ... | ... | Noted |
### Summary
- Files reviewed: X
- Findings: X
- Issues fixed: X
### Fixes Applied
- [list of changes made]
Copyright (c) 2026 Pauhu AI Ltd — MIT License — github.com/pauhu/claude-codex-review
Related Skills
stympy/research
development
VerifiedTrustedCommunity
Deep research before planning. Launches parallel agents to search docs, web, and codebase, then synthesizes findings into actionable context.
1SKILL.mdUpdated Apr 23, 2026
stympy/write-a-prd
development
VerifiedTrustedCommunity
This skill will be invoked when the user wants to create a PRD. You should go through the steps below. You may skip steps if you don't consider them necessary. 1. Ask the user for a long, detailed description of the problem they want to solve and any potential ideas for solutions. 2. Explore the repo to verify their assertions and understand the current state of the codebase. 3. Interview the user relentlessly about every aspect of this plan until you reach a shared understanding. Walk down e
1SKILL.mdUpdated Apr 15, 2026
stympy/slack-huddle-transcript
development
VerifiedTrustedCommunity
Extract and format Slack huddle transcripts for analysis. Use this skill when processing Slack huddle transcript files (.vtt), when user mentions huddle transcript or Slack transcript, when user uploads a VTT file from Slack, or when user asks to summarize or analyze a Slack meeting/huddle. Handles VTT format transcripts with speaker identification, timestamps, and conversation merging.
1SKILL.mdUpdated Apr 15, 2026
stympy/refactor-pass
development
VerifiedTrustedCommunity
--- name: refactor-pass description: Perform a refactor pass focused on simplicity after recent changes. Use when the user asks for a refactor/cleanup pass, simplification, or dead-code removal and expects build/tests to verify behavior. --- # Refactor Pass ## Workflow 1. Review the changes just made and identify simplification opportunities. 2. Apply refactors to: - Remove dead code and dead paths. - Straighten logic flows. - Remove excessive parameters. - Remove premature optimizati
1SKILL.mdUpdated Apr 15, 2026