Put a security skill where Codex already looks for skills.

The cross-client installer is the shortest path. It resolves the root skill file and copies the tree into the discovery directory.

git clone https://github.com/omarmohelal/SecHelix.git
mkdir -p .agents/skills
cp -R SecHelix/skills/sechelix .agents/skills/sechelix

In hosts with a subagent mesh, the independent verification pass runs as a separate agent that never sees the hunter narrative. Without that guarantee, get the same property by splitting the work across two requests and refusing to carry the conclusion between them.

Use SecHelix to audit this repository. Mode STATIC.
Map entrypoints, identities, trust boundaries, and state machines from the code, not from assumption.
Select only applicable catalog hypotheses and label the rest NOT_APPLICABLE, UNKNOWN, or BLOCKED.
Return candidates with an evidence chain. Do not promote anything to VERIFIED in this pass.

Then open the second pass with only the candidate. Not the confidence, not the severity you expect, and not the reasoning that produced it.

Here is a candidate finding from a previous review. Treat it as a claim to disprove.
Reconstruct the path from first principles. Do not assume the claim is correct.
Establish or refute each link: attacker control, reachability, boundary failure, safe reproduction,
impact, preconditions, root cause.
Classify it VERIFIED, LIKELY_BUT_UNPROVEN, FALSE_POSITIVE, DUPLICATE_ROOT_CAUSE, or
BLOCKED_BY_ENVIRONMENT, and state the refutation you attempted.

The property that matters is what the verifier is denied. A specialist role profile in the bundle states it directly: the verifier must not receive instructions that the candidate is true, or a severity that must be defended.

A meaningful share of the workflow is deterministic Python that imports nothing outside the standard library. You can run it from a terminal, from a Codex session, or from CI, and it returns the same answer every time.

python scripts/validate_contract.py report report.json
python scripts/security_gate.py report.json --policy policies/default.json
python -m adapters.cli semgrep semgrep.json --pretty
python -m reports.report_renderer report.json --format markdown

Contract validation

Rejects a report that does not satisfy the canonical schema, including a finding with no written refutation attempt.

Release gate

Exit 0 for PASS and PASS_WITH_KNOWN_RISK, 1 for BLOCKED, 2 for INCOMPLETE or malformed input.

Adapters

Eleven CLI names across nine modules. Every normalized record is CANDIDATE with severity, assessment, and verification all UNASSESSED.

Renderer

One canonical report renders to Markdown, redacted JSON, SARIF 2.1.0, and escaped standalone HTML.

This split is the point. The model does the reading and the reasoning. The contract decides what is allowed to be called a finding, and that decision does not vary between runs or between hosts. Every script above lives in the open repository, and the published run shows what they produced on a real application.

• Documented means the host vendor publishes the discovery mechanism. It does not mean we loaded it and watched it work.
• Verified means cold-installed and executed here, with the commands and their output recorded.
• The distinction is kept because collapsing it is how a compatibility table stops being useful.