registry / codex-review-cc / 1.2.0

codex-review-cc@1.2.0

Adversarial OpenAI Codex review for Claude Code: /codex:code-review and /codex:spec-review, debating Codex to convergence as a hard gate.

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 12.1 KB of source

Source & flagged code

2 flagged

bin/codex-review-cc.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Manual installer for the codex-review Claude Code commands, distributed via npm.

3// Copies runtime files into ${CLAUDE_HOME:-~/.claude}/commands/codex, overwriting in

4// place — so exactly one version ever lives there (no stale-cache accumulation), and it

5// shadows any stale plugin cache because the command discovery loop checks this dir first.

6"use strict";

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/codex-review-cc.jsView on unpkg · L6

9const os = require("os");

11const PKG = path.join(__dirname, "..");

12const VERSION = require(path.join(PKG, "package.json")).version;

13const DEST = path.join(process.env.CLAUDE_HOME || path.join(os.homedir(), ".claude"), "commands", "codex");

15// Runtime payload shipped into the commands dir. Keep in sync with install.sh + package.json "files".

16const ITEMS = [

17 "commands/spec-review.md",

18 "commands/code-review.md",

19 "codex-lib.sh",

20 "helpers",

21 "reference",

22 "schemas",

23];

25function copy(src, dst) {

26 const st = fs.statSync(src);

helpers/review-payload.shView file

•path = helpers/review-payload.sh kind = build_helper sizeBytes = 3575 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

helpers/review-payload.shView on unpkg

Source & flagged code

2 flagged · loading source

bin/codex-review-cc.jsView file

6"use strict"; L7: const fs = require("fs"); L8: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/codex-review-cc.jsView on unpkg · L6

helpers/review-payload.shView file

•path = helpers/review-payload.sh kind = build_helper sizeBytes = 3575 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

helpers/review-payload.shView on unpkg

Findings

3 Medium3 Low

MediumDynamic Requirebin/codex-review-cc.js

MediumEnvironment Vars

MediumShips Build Helperhelpers/review-payload.sh

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

bin/codex-review-cc.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Manual installer for the codex-review Claude Code commands, distributed via npm.

3// Copies runtime files into ${CLAUDE_HOME:-~/.claude}/commands/codex, overwriting in

4// place — so exactly one version ever lives there (no stale-cache accumulation), and it

5// shadows any stale plugin cache because the command discovery loop checks this dir first.

6"use strict";

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/codex-review-cc.jsView on unpkg · L6

9const os = require("os");

11const PKG = path.join(__dirname, "..");

12const VERSION = require(path.join(PKG, "package.json")).version;

13const DEST = path.join(process.env.CLAUDE_HOME || path.join(os.homedir(), ".claude"), "commands", "codex");

15// Runtime payload shipped into the commands dir. Keep in sync with install.sh + package.json "files".

16const ITEMS = [

17 "commands/spec-review.md",

18 "commands/code-review.md",

19 "codex-lib.sh",

20 "helpers",

21 "reference",

22 "schemas",

23];

25function copy(src, dst) {

26 const st = fs.statSync(src);

helpers/review-payload.shView file

•path = helpers/review-payload.sh kind = build_helper sizeBytes = 3575 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

helpers/review-payload.shView on unpkg