Codex Audit
Gather Context
Collect the recent changes for review:
- Git diff (staged + unstaged): !
git diff HEAD
- Recent commits on this branch: !
git log --oneline -10
- Git status: !
git status --short
Your Task
Prepare a summary of what was changed by reviewing the diff and recent commits above.
Run the following command, replacing <DIFF_SUMMARY> with a concise description of the changes, and piping the full diff via stdin:
git diff HEAD | codex exec --full-auto -m "gpt-5.4" -c 'model_reasoning_effort="high"' -c 'service_tier="fast"' -s danger-full-access -C "$(pwd)" "You are a code reviewer. The following diff is piped to your stdin. Review it for: bugs, security issues, performance problems, logic errors, and style concerns. Be specific about file names and line numbers. You can read files, run tests, search the web for relevant docs, or do whatever you need for a thorough review. If everything looks good, say so. Do a deep audit and think from first principles. Leave no question unanswered. Here is context about what changed: <DIFF_SUMMARY>"
If git diff HEAD is empty (no uncommitted changes), fall back to reviewing the last commit instead:
git diff HEAD~1 HEAD | codex exec --full-auto -m "gpt-5.4" -c 'model_reasoning_effort="high"' -c 'service_tier="fast"' -s danger-full-access -C "$(pwd)" "You are a code reviewer. The following diff is piped to your stdin. Review it for: bugs, security issues, performance problems, logic errors, and style concerns. Be specific about file names and line numbers. You can read files, run tests, search the web for relevant docs, or do whatever you need for a thorough review. If everything looks good, say so. Here is context about what changed: <DIFF_SUMMARY>"
Validate every finding before presenting it. The auditor (Codex) operates with limited context. It does not know the project's vision, strategic goals, or architectural rationale. It will often invent critical issues that are misunderstandings, or overstate the severity of things that are intentional design choices. For each finding Codex returns, you MUST:
- Check the actual source code to confirm the issue is real, not a hallucination or misread.
- Check any local strategic/planning documents (e.g.
agents.md, README.md, CLAUDE.md, current_*.md, or similar docs in the repo or in a /doc/ folder DEV_JOURNAL.md etc) to see if the finding conflicts with the stated project intent.
- Ask yourself: "Is this a real bug, or is Codex misunderstanding the context?" and "Even if real, is this meaningful or is it trivial/stylistic noise?"
- If there are findings that are not both real AND meaningful, share them with the user but clearly label them and with your reasons why.
Present the validated findings to the user. For each one, briefly note why you believe it's legitimate. If Codex gave the all-clear, or if all findings failed validation, say so.
Ask the user if they'd like to address any of the validated feedback.
1---2name: auditcodex3description: Send recent work to OpenAI Codex CLI for an independent audit/review4---56# Codex Audit78## Gather Context910Collect the recent changes for review:1112- Git diff (staged + unstaged): !`git diff HEAD`13- Recent commits on this branch: !`git log --oneline -10`14- Git status: !`git status --short`1516## Your Task17181. Prepare a summary of what was changed by reviewing the diff and recent commits above.19202. Run the following command, replacing `<DIFF_SUMMARY>` with a concise description of the changes, and piping the full diff via stdin:2122```23git diff HEAD | codex exec --full-auto -m "gpt-5.4" -c 'model_reasoning_effort="high"' -c 'service_tier="fast"' -s danger-full-access -C "$(pwd)" "You are a code reviewer. The following diff is piped to your stdin. Review it for: bugs, security issues, performance problems, logic errors, and style concerns. Be specific about file names and line numbers. You can read files, run tests, search the web for relevant docs, or do whatever you need for a thorough review. If everything looks good, say so. Do a deep audit and think from first principles. Leave no question unanswered. Here is context about what changed: <DIFF_SUMMARY>"24```2526If `git diff HEAD` is empty (no uncommitted changes), fall back to reviewing the last commit instead:2728```29git diff HEAD~1 HEAD | codex exec --full-auto -m "gpt-5.4" -c 'model_reasoning_effort="high"' -c 'service_tier="fast"' -s danger-full-access -C "$(pwd)" "You are a code reviewer. The following diff is piped to your stdin. Review it for: bugs, security issues, performance problems, logic errors, and style concerns. Be specific about file names and line numbers. You can read files, run tests, search the web for relevant docs, or do whatever you need for a thorough review. If everything looks good, say so. Here is context about what changed: <DIFF_SUMMARY>"30```31323. **Validate every finding before presenting it.** The auditor (Codex) operates with limited context. It does not know the project's vision, strategic goals, or architectural rationale. It will often invent critical issues that are misunderstandings, or overstate the severity of things that are intentional design choices. For each finding Codex returns, you MUST:33 - Check the actual source code to confirm the issue is real, not a hallucination or misread.34 - Check any local strategic/planning documents (e.g. `agents.md`, `README.md`, `CLAUDE.md`, `current_*.md`, or similar docs in the repo or in a /doc/ folder `DEV_JOURNAL.md` etc) to see if the finding conflicts with the stated project intent.35 - Ask yourself: "Is this a real bug, or is Codex misunderstanding the context?" and "Even if real, is this meaningful or is it trivial/stylistic noise?"36 - If there are findings that are not both real AND meaningful, share them with the user but clearly label them and with your reasons why.37384. Present the validated findings to the user. For each one, briefly note why you believe it's legitimate. If Codex gave the all-clear, or if all findings failed validation, say so.39405. Ask the user if they'd like to address any of the validated feedback.
j5ik2o