Claude Code × Codex Collaborate
ReviewAudited by ClawScan on May 15, 2026.
Overview
This skill is mostly transparent about coordinating Claude Code and Codex, but it can execute a Codex command taken from project configuration and can persist/forward broad project context, so it deserves review before use.
Before installing or using this skill, inspect any existing docs/cccc/config.json and make sure codex.cli_command points only to the real trusted Codex CLI. Expect repository context and diffs to be prepared for Codex review, keep logs out of git, and enable loop-start hooks only when you intentionally want the agent to continue working across stop events.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you run this in a project with an untrusted docs/cccc/config.json, the skill could execute a non-Codex program during review and feed it the prepared project context.
The executable used for review is taken from a project config file and then run. Quoting prevents simple shell injection, but a config can still point to a different executable such as a repo-local or attacker-controlled program.
CLI_CMD="$(jq -r '.codex.cli_command // "codex"' docs/cccc/config.json ... )" ... if "$CLI_CMD" exec --cd "$ROOT" --sandbox read-only ... - < "$PROMPT"
Before importing or keeping an existing config, verify codex.cli_command is exactly the trusted Codex binary or a trusted absolute path. The skill should validate or require explicit confirmation for any non-default command.
Project source, diffs, and selected untracked file contents may be provided to Codex or to whatever executable is configured as the Codex CLI.
The context bundle intentionally collects repository diffs and previews of safe small untracked files for Codex review. This is aligned with the stated review workflow, but it may include proprietary or sensitive code.
echo "\n## Git diff"; git diff -- . ':!docs/cccc/context-bundle.md' ... echo "### Untracked File Contents" ... sed -n "1,${MAX_LINES}p" "$file"Review docs/cccc/context-bundle.md before review runs on sensitive projects, remove secrets from diffs, and avoid using this skill on repositories whose contents should not be shared with the configured review provider.
Conversation or runtime details may remain in the repository workspace and could be accidentally reviewed, reused, or committed.
The stop hook stores hook input under docs/cccc/logs. Those logs can contain runtime or conversation context and are later available to the skill's trace/context tooling.
echo "$INPUT" > "$LOG_DIR/stop-$STAMP.json"
Keep docs/cccc/logs out of version control, periodically delete old logs, and avoid enabling hooks when working with secrets or highly sensitive project details.
The agent may continue working across multiple steps without stopping after each response while loop mode is enabled.
When the optional stop hook is enabled, it can block Claude Code from stopping and instruct it to continue the workflow until a terminal or pause condition is reached.
decision: "block" ... "Continue the cc-codex-collaborate state machine" ... "Do not stop after a single small step."
Enable loop automation only for tasks where you are comfortable with continued execution, monitor docs/cccc/state.json, and use the loop-stop command or remove the hooks when finished.
Codex review may run under your existing Codex CLI login or account configuration.
The skill expects use of the user's installed Codex CLI/account for reviews. That is central to the advertised purpose, but it is still delegated account use.
"codex": { "enabled": true, "required": true, "fail_closed": true, "cli_command": "codex", "sandbox": "read-only" }Confirm which Codex account/profile the CLI uses and ensure it is appropriate for the repository before starting reviews.