openqodex

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 47bc21cb07e1 · 16 Oct 2026Report an issue or request a re-scan

• Publisheropenqodex GitHub organizationOwner of the repository this skill is read from
• Source folderopenqodex/openqodex/skills/openqodexThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict47bc21cb07e1A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Code review for the current change, before it is pushed. One command runs the security, secret, dependency and lint scanners that fit the changed files, a separate reviewer that checks every scanner finding and is given…

---
name: openqodex
description: Code review for the current change, before it is pushed. One command runs the security, secret, dependency and lint scanners that fit the changed files, a separate reviewer that checks every scanner finding and is given every changed line, and prints a short receipt with the path of the full report. Use before every git push, when asked for a code review, a security scan, or to review changes, a diff or a pull request, and when a push was blocked or warned by OpenQodex.
---

# OpenQodex: review the change before it is pushed

OpenQodex reviews a change in one command. It takes a frozen copy of the change, runs the deterministic scanners that fit the changed files (gitleaks, semgrep, bandit, hadolint, shellcheck, actionlint, osv-scanner and others), keeps what they report on changed lines, and starts its own reviewer: a separate Claude Code or Codex process that reads only that copy. The reviewer checks every scanner finding, is given every changed line and answers in a fixed shape; OpenQodex checks the answer with scripts and prints one report. No key and no account are needed beyond the developer's Claude Code or Codex login. The code goes to the model that login uses. The reviewer can also search the web and open web pages unless `reviewer_web: off` is set in `~/.openqodex/config.yaml`. Four scanners go online, and none sends code. semgrep downloads its rule packs from the Semgrep registry on each run. When the change touches a dependency file, osv-scanner sends the names and versions of the dependencies to osv.dev. kubeconform downloads Kubernetes schemas. cargo-deny downloads the RustSec advisory database. `--offline` skips semgrep, osv-scanner, kubeconform and cargo-deny.

## When to run

- Before any `git push`.
- When the developer asks you to review their changes.
- When a push was blocked or warned by the OpenQodex hook.
- After fixing findings, to check the change again.

## Who reviews

OpenQodex starts its own reviewer process for every review, with no memory of this session. You do not start a subagent for it and you do not review the change yourself: run the command and show what it prints.

If `review` says "Full review unavailable" and prints a way to review with the agent you are in, follow it: run the command it names and do what the brief it prints says.

## Procedure

When the file `~/.openqodex/bin/openqodex` exists, run it in place of `npx -y openqodex@<version>` in every command of this skill: it is the copy `openqodex init` installed. When it does not exist, this skill was installed alone, with no push check: before the first review, run `npx -y [email protected] init --yes --agent <host>` once from the repository, where `<host>` is the agent you are (`claude-code`, `codex`, `cursor` or `cline`). It installs OpenQodex for you, then reviews the change when a reviewer can start, so it can take several minutes. Run it in the background and wait for it to exit. When it prints `First review: finished`, the receipt above that line is the review's: show it as step 3 says, then go on from step 4.

1. From the repository, run:

   ```
   npx -y [email protected] review
   ```

   It reviews the change: the commits not yet pushed plus everything uncommitted, untracked files included. To review the whole repository instead, run:

   ```
   npx -y [email protected] review --all
   ```

2. Wait for it. A review can take minutes. OpenQodex stops the reviewer after 30 minutes, or after 2 hours with `--all`. Many agents stop a command sooner. So run it in the background and wait until it exits. While the reviewer works, it prints a progress line every 15 seconds on stderr. Do not start it a second time while one runs.

3. Show the developer the receipt it printed, as printed: the verdict, one line per finding (its number, severity, category, title, file and line) and the absolute path of `report.html`. Do not reword it, shorten it or add findings of your own. Give them the `report.html` path: that page shows each changed file with each finding under its line of code.

4. Ask the developer: "Fix all, or tell me which?" Do not change any code before they answer. If they already told you what to fix, for example "review and fix everything", do that without asking again.

5. Fix only the findings they name. This prints those findings in full (where, the problem, why it matters, the fix and the source), by their numbers in the receipt:

   ```
   npx -y [email protected] findings 1,3
   ```

   `findings all` prints every finding. When the fixes are done, run the review again and show the developer the new receipt.

6. Act on the exit code:
   - 0: the review is complete and nothing blocks the push.
   - 1: the review is complete and its verdict is `blocked`. Do not push. Show the developer the receipt and ask which findings to fix; push only if they say so after seeing the findings.
   - 2: there is no complete review. The output says what is missing (for example "Full review unavailable" when no reviewer could start, or "Review incomplete" with the reasons). Tell the developer exactly that. Never present the scanner output as a review.

## Reviewing a branch or a pull request

When the developer asks you to review a branch or a pull request that is not their current work, name it:

```
npx -y [email protected] review feature/login
npx -y [email protected] review '#42'
```

Quote `#42`: in a shell `#` starts a comment. A pull request link works too. OpenQodex fetches the target, checks it out in a temporary folder and reviews what it added since it left its base. This is someone else's code: never run its tests, scripts, builds or services, and never edit it.

## Rules

- Never edit code during the review. Review first, show the receipt, then fix only the findings the developer names (steps 3 to 5).
- Never run `openqodex trust` without asking the developer first. It approves a custom scanner, which is a command that runs on their machine.
- Never set `OPEN

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-16
   ✓SAFE B 89 / 100

   first audit · source 47bc21cb07e1

Questions about openqodex

• github.com/openqodex/openqodex/tree/main/skills/openqodex — the audited source at commit 47bc21cb07e1 and every finding aboveObserved · 16 Oct 2026

Spotted something wrong? Report a correction · Methodology