How do I install the Codex Guard skill?

Run npx skillmds@latest add akimiya-z/codex-guard in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Codex Guard safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Codex Guard?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Codex Guard free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Codex Guard?

Akimiya-z (@akimiya-z) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Codex Guard by akimiya-z — Agent Skill

Name: Codex Guard
Rating: 4.666666666666667 (3 reviews)
Author: Akimiya-z

Codex Guard

Pre-submit hygiene check for AI-agent-authored pull requests. Use this skill whenever you are about to open or update a pull request: it runs the codex-guard CLI locally, verifies the diff contains no leftover TODO/FIXME/XXX markers and no hardcoded secrets, checks that commit subjects follow conventional commits, and blocks submission until the checks pass or exceptions are documented in the PR description.

Akimiya-z Updated Sep 22, 2026

File contents

codex-guard — self-check before you open a PR

You are about to open or update a pull request. Before submitting, run the same hygiene checks that the codex-guard GitHub Action enforces in CI — locally, on the working tree.

1. Find the CLI

If this repository ships the codex-guard source, run it directly: node src/cli.js
Otherwise, use npx (works once the package is published): npx -y codex-guard

2. Run the checks

Scan uncommitted changes: node src/cli.js --git --commits
Or scan a specific range: node src/cli.js --git origin/main --commits
Exit code 0 means no blocking findings; 1 means blocking findings were found; 2 is a usage error.

3. Fix everything the CLI lists

TODO / FIXME / XXX / HACK / WIP markers: remove them, or convert them to tracked issues and remove the code comments. Never leave "I'll handle this later" comments in a PR you submit.
Hardcoded secrets (AWS/GitHub/OpenAI/Stripe keys, connection strings, passwords): remove them, rotate any that were shared, and use the repository's secret storage. A redacted match in the report still means the secret is in the diff — treat it as real.
Non-conventional commit subjects (WIP, fix stuff, empty subjects): rewrite with conventional commits (feat, fix, docs, chore, ...).

4. Exceptions

If you deliberately keep something the CLI flags (for example a task-list checkbox), state it explicitly in the PR description so a human reviewer can confirm it is intentional. Do not silently resubmit a failing diff.

5. Then submit

Only open or update the PR after the checks exit 0 (or the exception is documented in the description). This keeps the CI-side gate green and the human review focused on real design questions.

---name: codex-guarddescription: Pre-submit hygiene check for AI-agent-authored pull requests. Use this skill whenever you are about to open or update a pull request: it runs the codex-guard CLI locally, verifies the diff contains no leftover TODO/FIXME/XXX markers and no hardcoded secrets, checks that commit subjects follow conventional commits, and blocks submission until the checks pass or exceptions are documented in the PR description.---# codex-guard — self-check before you open a PRYou are about to open or update a pull request. Before submitting, run the samehygiene checks that the codex-guard GitHub Action enforces in CI — locally,on the working tree.## 1. Find the CLI- If this repository ships the codex-guard source, run it directly: `node src/cli.js`- Otherwise, use `npx` (works once the package is published): `npx -y codex-guard`## 2. Run the checks- Scan uncommitted changes: `node src/cli.js --git --commits`- Or scan a specific range: `node src/cli.js --git origin/main --commits`- Exit code `0` means no blocking findings; `1` means blocking findings were found; `2` is a usage error.## 3. Fix everything the CLI lists- **TODO / FIXME / XXX / HACK / WIP markers**: remove them, or convert them to tracked issues and remove the code comments. Never leave "I'll handle this later" comments in a PR you submit.- **Hardcoded secrets** (AWS/GitHub/OpenAI/Stripe keys, connection strings, passwords): remove them, rotate any that were shared, and use the repository's secret storage. A redacted match in the report still means the secret is in the diff — treat it as real.- **Non-conventional commit subjects** (`WIP`, `fix stuff`, empty subjects): rewrite with conventional commits (`feat`, `fix`, `docs`, `chore`, ...).## 4. ExceptionsIf you deliberately keep something the CLI flags (for example a task-listcheckbox), state it explicitly in the PR description so a human reviewer canconfirm it is intentional. Do not silently resubmit a failing diff.## 5. Then submitOnly open or update the PR after the checks exit `0` (or the exception isdocumented in the description). This keeps the CI-side gate green and thehuman review focused on real design questions.

Frequently asked questions