audit-repo skill
A Codex skill for repository health audits covering tests, CI, dependencies, security signals and tech debt, with evidence.
- 155 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skill is read-only, but its report lists the names of sensitive project files.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/audit-repoDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skill is read-only, but its report lists the names of sensitive project files.
This is third-party code. Review the repository files before installing.
What it does
`audit-repo`, a Codex skill, reads a repository without changes and collects signals: Git state, manifests and lockfiles, tests, CI, containers, large files and sensitive-looking filenames. The skill never opens the contents of sensitive files. The `scripts/collect_repo_signals.py` script collects signals and outputs Markdown or JSON. Codex then checks context and turns signals into a prioritized action list. Two JSON snapshots can be compared to see what changed.
Who it is for. Developers and team leads on Codex who need a quick state overview of someone else's or an inherited repository.
Good fit when
- A team inherits a project and wants tests, CI and dependencies in one report.
- Before a release two snapshots are compared to catch lost CI, new large files and suspicious filenames.
- A monorepo is audited by separate paths through `--include-path` and `--exclude-path`.
- CI keeps a stable baseline snapshot in `tracked` mode.
Not a fit when
- A vulnerability scanner is required, while the skill collects signals and does not search for CVEs.
- The agent is not Codex, while the instructions target the Codex skills directory.
- Final conclusions are expected without checking, while signals still need confirming in context.
Example request
Use $audit-repo to audit this repository and name the five most important fixes with evidence.Limitations
The collector outputs an inventory of signals rather than finished findings: the README stresses that the agent assigns priority and impact after checking context. Python 3.10 or newer is required, and the scripts use only the standard library. Version 1.9.0 changed scan semantics, so 1.8.x snapshots compare with a caveat, and 1.9.1 changed how Windows junctions and symlinks are traversed. Keep comparison snapshots outside the audited repository. The last commit is from August 31, 2026.
How to disable. Delete the `audit-repo` folder from `~/.agents/skills`. The script installs nothing and runs nothing in the background.
FAQ
Does the skill read secrets?
No. Filename checks never open or print the contents of sensitive files.
How do I run the collector without an agent?
Run `python scripts/collect_repo_signals.py /path/to/repo --format markdown`. For a JSON snapshot add `--format json --output before.json`.
Which scan modes exist?
Three: `filesystem` by default, `git-visible` and `tracked`. For a stable CI baseline `tracked` fits.
Which languages and stacks does the collector recognize?
Python, JavaScript, .NET, Swift, JVM, Go, Rust, Ruby and PHP, via manifests, lockfiles, tests and CI configuration.
How do I compare two audits?
Save JSON snapshots with `--format json --output` and compare them. Keep snapshots outside the audited repository.
Discussion
No questions or reviews yet.
Related
Skills61 small skills for Codex across 13 areas: codebase orientation, tests, migrations, security, CI and pull request review
A Codex skill that runs a loop of measurable experiments over a repository toward a numeric target: change, verify, revert failures, repeat
Awesome Codex Skills
awesome-codex-skills
A set of practical skills for Codex CLI and API from the Composio community: error triage, research, changelogs, CI fixes
Codex Settings skills
Codex CLI Skills & Profiles
A Codex CLI plugin with twelve skills: deep research, pull request review, image generation and session handoff
A Codex plugin for measured experiments in a repo: a baseline metric, tested small changes, and a patch with evidence
CLI and GitHub Action that triages issues, reviews pull requests and drafts release notes with code references.
README in short
The README covers installing via `$skill-installer` and by hand, standalone script use and three scan modes. Separate paragraphs explain the boundaries between snapshot versions.