Deep Code Audit

English | 简体中文

A reusable Codex skill for read-only, evidence-backed audits of software repositories.

What it does

• Freezes the repository identity, dirty state, scope, and authorization boundary.
• Treats builds and tests as potentially stateful and requires isolated validation.
• Audits finite, end-to-end risk chains instead of reading files without a stopping rule.
• Separates severity from evidential certainty: confirmed defect, credible risk, coverage gap, or improvement suggestion.
• Challenges candidate findings with counterevidence and records exclusions.
• Distinguishes automated gates from real runtime and production acceptance.
• Provides practical validation strategies for races and other nondeterministic defects.

The default workflow is advisory. It does not modify source, user data, production state, dependencies, commits, or releases unless the user grants separate authorization.

Install

PowerShell:

git clone https://github.com/lyq2010/deep-code-audit.git "$env:USERPROFILE\.codex\skills\deep-code-audit"

macOS or Linux:

git clone https://github.com/lyq2010/deep-code-audit.git "$HOME/.codex/skills/deep-code-audit"

Start a new Codex task after installation so the skill catalog is refreshed.

Use

Invoke it explicitly:

$deep-code-audit Perform a read-only deep audit of this repository and give prioritized improvement recommendations.

It is also designed to trigger for requests such as deep code reviews, repository-wide security or reliability audits, architecture risk reviews, and comprehensive improvement recommendations.

Report model

The skill reports:

1. Audit identity, scope, environment, and isolation boundary.
2. Confirmed defects and credible risks, ordered by severity and certainty.
3. Coverage gaps and improvement suggestions in separate sections.
4. Must-trace chain status and runtime-scenario coverage.
5. Exact validation evidence, exclusions, blockers, and unverified conditions.

See SKILL.md for the complete workflow.