# Security Audit

**Repository Path**: xiaoshuai456/security-audit

## Basic Information

- **Project Name**: Security Audit
- **Description**: Audits Codex external downloads before use, checking sources, files, dependencies, scripts, binaries, archives, and risky commands. Requires confirmation for non-low risk.
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-06-05
- **Last Updated**: 2026-06-05

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# Safety Audit

Safety Audit is a Codex skill for reviewing external downloads before they are used. It helps reduce malware, destructive-file, and supply-chain risks when Codex needs to download, install, unpack, import, or execute content from outside the local workspace.

## What It Checks

- Source reputation and whether the source is official or expected
- Git repositories, package-manager dependencies, plugins, and remote artifacts
- Scripts, binaries, archives, installers, images, model files, and config files
- Install hooks, lifecycle scripts, package manifests, lockfiles, CI files, and shell commands
- Risky behaviors such as credential access, obfuscation, persistence, privilege escalation, destructive commands, or suspicious network activity

## Core Behavior

- Audits every external download, regardless of file type.
- Treats external content as untrusted until reviewed.
- Prevents execution, installation, importing, or moving into a trusted project path before review.
- Requires explicit user confirmation for medium, high, or unknown risk.
- Reports audit results in Chinese using the required report format defined in `SKILL.md`.

## Installation

Clone this repository into your Codex skills directory:

```bash
git clone https://gitee.com/xiaoshuai456/security-audit.git ~/.codex/skills/safety-audit
```

Restart Codex after installation so the skill list can refresh.

## Usage

Invoke the skill explicitly:

```text
Use $safety-audit to audit this external download before installing it.
```

It should also be used whenever Codex needs to fetch or use external content, including URLs, Git repositories, package dependencies, scripts, binaries, archives, plugins, or other remote artifacts.

## Limitations

This skill cannot prove that a file is completely safe. It is designed to surface suspicious signals, reduce avoidable risk, and require user confirmation before continuing with uncertain or dangerous actions.