VoltAgent/awesome-codex-subagents

No problems traced to this repository code in these checks.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Copying an agent .toml file into the agent directory installs it: Real input produced the expected result: name = "backend-developer"

  Source: Copy the `.toml` agent files you want into one of the directories above.

  Input: categories/01-core-development/backend-developer.toml

  Expected: copied file in output contains name = "backend-developer"

  Command: cp categories/01-core-development/backend-developer.toml <guest-path>

  Observed: name = "backend-developer" description = "Use when a task needs scoped backend implementation or backend bug fixes after the owning path is known." model = "gpt-5.6-sol" model_reasoning_effort = "high" sandbox_mode = "workspace-write" developer_instructions = """ Own backend changes as production behavior with explicit data, auth, and failure-path integrity. Working mode: 1. Map entry point, domain logic boundary, and persistence side effects. 2. Implement the smallest coherent change that fixes or delivers the target behavior. 3. Validate behavior under normal and high-risk failure paths. F

Examples

• Install a global Codex subagent with the README example command: command completed successfully with no output

  Source: README.md Installation example (mkdir -p ~/.codex/agents; cp categories/01-core-development/backend-developer.toml ~/.codex/agents/)

  Input: categories/01-core-development/backend-developer.toml

  Expected: file copied into the guest HOME agents directory (<guest-path>, since HOME=<guest-path>)

  Command: cp categories/01-core-development/backend-developer.toml <guest-path>

Local or hosted: hosted

Install and use the Codex subagent definitions from awesome-codex-subagents (pinned 16f880a2a0486f880da75d2baffcd68af4cc4811)

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -200; ls /inputs 2>/dev/null; ls <guest-path> 2>/dev/null
cd <guest-path> && grep -n '```' README.md | head -50; echo ---; sed -n '/^## /p' README.md; echo ---; ls -la .coldpass; echo ---; find . -path ./.git -prune -o -type f ! -name '*.toml' -print | head -50; echo ---; find categories -name '*.toml' | wc -l; echo ---; cat CONTRIBUTING.md | head -80
cd <guest-path> && sed -n '/^## Understanding Subagents/,/^## Contributing/p' README.md | head -120; echo ---; sed -n 425,450p README.md; echo ---; ls /inputs 2>&1; head -60 <guest-path>
cd <guest-path> && git --version; git init -q && git remote add origin https://github.com/VoltAgent/awesome-codex-subagents && timeout 120 git fetch --depth 1 origin 16f880a2a0486f880da75d2baffcd68af4cc4811; echo "fetch rc=$?"; git reset -q --mixed FETCH_HEAD; echo "reset rc=$?"; git rev-parse HEAD; git status --short | head -20
cd <guest-path> && mkdir -p ~/.codex/agents && cp categories/01-core-development/backend-developer.toml ~/.codex/agents/ && ls -la ~/.codex/agents/ && cat ~/.codex/agents/backend-developer.toml | head -30; echo ---; python3 -I -c '
import tomllib,glob
bad=[];n=0
for f in sorted(glob.glob("categories/*/*.toml")):
    n+=1
    try:
        d=tomllib.load(open(f,"rb"))
        for k in ("name","description","developer_instructions"):
            if k not in d and not (k=="developer_instructions" and "instructions" in d): bad.append((f,"missing "+k))
    except Exception as e: bad.append((f,str(e)))
names=[]
print("files",n,"problems",len(bad))
for b in bad[:20]: print(b)
'
cd <guest-path> && mkdir -p .coldpass <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["cp","categories/01-core-development/backend-developer.toml","<guest-path>"],"cwd":"<guest-path>","expected_file":"<guest-path>","expected_text":"name = \"backend-developer\""}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Copying an agent .toml file into the agent directory installs it","source":"Copy the `.toml` agent files you want into one of the directories above.","input":"categories/01-core-development/backend-developer.toml","expected":"copied file in output contains name = \"backend-developer\"","probe_kind":"cli","argv":["cp","categories/01-core-development/backend-developer.toml","<guest-path>"],"expected_file":"<guest-path>","expected_text":"name = \"backend-developer\"","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Install a global Codex subagent with the README example command","source":"README.md Installation example (mkdir -p ~/.codex/agents; cp categories/01-core-development/backend-developer.toml ~/.codex/agents/)","input":"categories/01-core-development/backend-developer.toml","expected":"file copied into <host-path>","env":{}}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md, CONTRIBUTING.md, and all 175 .toml files. The repository is a static collection of Codex subagent definitions with no scheduler, cron, loop, webhook, --once or --now entry point; no CI workflow directory exists. Nothing runs on a schedule.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay; echo "checker rc=$?"
echo "HOME=$HOME whoami=$(whoami)"; echo "~ -> $(eval echo ~)"; ls -la ~/.codex/agents/ 2>&1; ls -ld <host-path> <host-path> 2>&1; ls -la <guest-path>
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Install a global Codex subagent with the README example command","source":"README.md Installation example (mkdir -p ~/.codex/agents; cp categories/01-core-development/backend-developer.toml ~/.codex/agents/)","input":"categories/01-core-development/backend-developer.toml","expected":"file copied into the guest HOME agents directory (<guest-path>, since HOME=<guest-path>)","argv":["cp","categories/01-core-development/backend-developer.toml","<guest-path>"],"cwd":"<guest-path>","env":{}}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c 'import json,sys; d=json.load(sys.stdin); print("valid:",d["valid"]); print("problems:",d["problems"]); print("status:",d["replay"]["status"], d["replay"]["details"].get("evidence_strength"))'; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"unsupported","fault_owner":"repo","operation":"Install and use the Codex subagent definitions from awesome-codex-subagents (pinned 16f880a2a0486f880da75d2baffcd68af4cc4811)","operation_scope":"Static repository of 175 Codex .toml subagent files. The only documented actions are copying .toml files into ~/.codex/agents/ or .codex/agents/ and then delegating to them inside Codex. Codex itself is external and not installed in this guest; the README gives no runnable install command for it. No server, CLI, or library is provided, and no tests or CI exist.","steps":["git init; git remote add origin https://github.com/VoltAgent/awesome-codex-subagents; git fetch --depth 1 origin 16f880a2a0486f880da75d2baffcd68af4cc4811; git reset --mixed FETCH_HEAD (HEAD verified at pinned commit, clean tree)","README Installation: mkdir -p ~/.codex/agents && cp categories/01-core-development/backend-developer.toml ~/.codex/agents/ (succeeded, with HOME=<guest-path>)","CONTRIBUTING validation checklist: parsed all 175 categories/*/*.toml with python3 -I tomllib, checking name/description/developer_instructions (0 problems)","COLDPASS checker --validate --replay: PASS, valid=true, no problems"],"deviations":["Git metadata was added with git init and fetch, as the task instructed; the README does not require it.","The README example uses ~, which resolves to HOME=<guest-path> in this guest. The first replay example used an absolute <host-path> path that does not exist, so it failed. I corrected the example to <guest-path> and re-ran; it passed.","The probe and claim are plain file copies (cp). The task classes file tests as setup only, so they are not evidence of product behaviour. No real product operation exists to exercise.","Codex was not installed. No Codex-native behaviour (agent discovery, delegation) was tested."],"stuck_step":null,"main_blocker":"The repository is a collection of agent definition files with no runnable product. Nothing in it can be started, called, or tested beyond file copying and TOML parsing.","plain_failure":"This repository contains no program to run. It is a set of agent instruction files. The only things the README asks you to do are copy those files into a folder, and Codex then reads them. I could copy and validate the files, but the agents themselves can only be exercised inside Codex, which is not part of this repository and was not set up here.","suggested_fix":"If this should be testable, the repo would need a runnable check that Codex loads each agent (for example, a documented command that lists or invokes the installed agents), or an offline validator added to CI that the README points to. Otherwise, treat it as a content-only repo and mark it unsupported for runtime testing."}
EOF
python3 -I -c 'import json;json.load(open(".coldpass/report.json"));print("report ok")'; ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c 'import json,sys; d=json.load(sys.stdin); print("valid:",d["valid"], "problems:",d["problems"])'