Codex Automation and Skill Audit

A weekly safety review for Codex automations and personal skills.

The audit reads the last seven complete days of runs. It finds repeated user fixes, slow steps, mixed rules, unsafe gaps, and work that needed too much steering. It then gives numbered, patch-ready recommendations.

The scheduled audit is read-only. Files change only after the user approves a recommendation number or says approve all in the same Codex task.

What it checks

  • Recurring Codex automation prompts
  • Personal skill folders
  • Local Markdown files named by those prompts and skills
  • Automation memories and runbooks
  • Recent Codex tasks, including manual skill use
  • Repeated user corrections and approval changes

Safety model

The workflow has two clear parts:

  1. The weekly run reads and recommends. It does not patch files.
  2. A later reply can approve named recommendations. Only those approved files may change.

The skill also blocks external messages, live app changes, deployments, and unrelated repo edits during an audit.

How it chooses a fix

The audit uses this order:

  1. Delete a stale or repeated rule.
  2. Simplify or merge a rule that already exists.
  3. Replace one rule when needed.
  4. Add a new rule only when the current text cannot own the behavior.

Every recommendation names its change type and a safety test. A new rule must explain why an edit or deletion cannot solve the problem.

Repo files

No task history, automation memory, login data, API key, or private workspace file is included.

Install the skill

Clone this repo, then copy the skill into your Codex skills folder:

git clone https://github.com/adonis-cyril/codex-automation-audit.git
cd codex-automation-audit

python3 scripts/sync_local.py --apply

Add the weekly automation

  1. Open Codex Automations.
  2. Create a weekly automation in the workspace you want to review.
  3. Paste the text from automation/PROMPT.md.
  4. Replace <WORKSPACE_PATH> with the full path to that workspace.
  5. Pick your day, time, timezone, model, and reasoning level in Codex.
  6. Keep the run local so it can read your local automation and skill files.

The TOML file is a reference template. Create the automation through Codex so its local project ID and other runtime fields are saved correctly.

Expected result

The audit ends with recommendations such as R1, R2, and R3. Each one should include:

  • the proof from recent runs
  • the file that owns the rule
  • the exact small patch
  • the expected result
  • confidence and approval status

Reply with a recommendation number to patch only that item. Reply with approve all to patch every patch-ready item from the latest report.

Tests and rollback

Run the contract checks before publishing a change:

python3 scripts/validate.py

The validator protects the read-only run, approval gate, privacy limits, reduction order, sample output, and automation template. The cases in tests/reduction-cases.md check whether the audit chooses the right kind of fix.

Use Git tags and commits for history. You do not need dated copies of the whole skill folder. Git keeps compressed history, and this skill is small.

A hash can prove that text changed, but it cannot restore missing text. Exact rollback needs Git history or app history. This repo versions the skill and a clean automation template. The live launcher stays small and keeps local paths out of the public repo.

To undo a bad public change, use git revert <commit>. To restore an older installed version without changing your checkout, run:

python3 scripts/sync_local.py --revision v1.0.0 --apply

Run the validator again after any rollback.

Privacy notes

This skill reads local Codex data. Review the prompt and skill before use. Keep private lead files, raw transcripts, credentials, workbooks, and client exports out of scope unless you clearly ask for one exact file.

License

MIT