building-secure-contracts

Claude Code and Codex Skills for Software Correctness
Formal verification, model checking, security auditing, proof repair, and benchmarking — as slash commands.

Contents

• Quick Start
• Codex User-Level Install
• Codex Workspace Install
• Plugins
  • fuzzer — Coverage-guided fuzzing for C/C++, Rust, and Go
  • kani-proof — Model checking for Rust and Solana
  • solana-audit — Smart contract security audits
  • axiom — Lean 4 proof verification and repair
  • skill-benchmark — Measure whether a skill actually helps
  • workers-app-tester — Mobile application security testing
  • save — Convert sessions into reusable agents
• Repository Structure
• Contributing
• License

Quick Start

Install every plugin for Claude Code in one command:

npx skills add workersio/spec

Individual plugins can be selected during installation. Once installed, invoke any skill by name inside Claude Code:

/fuzzer            Coverage-guided fuzzing with audit-driven harness design
/kani-proof        Write bounded model checker proofs for Rust and Solana
/solana-audit      Run a structured smart contract security audit
/axiom             Verify and repair Lean 4 proofs
/skill-benchmark   Benchmark a skill with controlled eval sessions
/workers-app-tester   Pentest an Android app on a rooted device
/save              Save the current session as a reusable agent

Claude and Codex support are included through repo-local metadata:

• Claude marketplace catalog: .claude-plugin/marketplace.json
• Codex marketplace catalog: .agents/plugins/marketplace.json
• Per-plugin Codex manifests: plugins/<name>/.codex-plugin/plugin.json
• The Claude marketplace currently exposes 45 plugins from the repo root
• The Codex marketplace currently exposes 36 plugins: the original 7 Codex-ready plugins plus 29 low/medium-risk Claude-source ports staged under root plugins/

To use this repo as a repo-scoped Codex marketplace:

1. Keep the repository layout intact so .agents/plugins/marketplace.json can resolve ./plugins/<name> relative to the repo root.
2. Restart Codex after cloning the repo or after changing marketplace metadata.
3. In Codex CLI, run codex, then /plugins, open the workersio marketplace, and install the plugins you want.

Claude-source plugin ports are now managed from the root repo through:

• plugins/catalog.json — root inventory for existing plugins and vendored Claude-source ports
• scripts/sync-root-plugins.mjs — copies skills/plugins/<name> into root plugins/<name> and generates manifests
• scripts/validate-root-plugins.mjs — validates manifest parity, marketplace drift, and SKILL.md relative links
• .codex-port/preserve-paths.json inside any copied plugin — opt-in list of root-only files to restore after re-sync when a plugin gets Codex-specific adaptations

Current port policy:

• Codex marketplace publishes all low/medium-risk ports plus the original 7 Codex-ready plugins
• 9 high-risk Claude workflows remain staged in root plugins/ but blocked from the Codex marketplace until their hook/MCP/task-specific behavior is ported
• Currently blocked from Codex marketplace: fp-check, gh-cli, git-cleanup, modern-python, second-opinion, skill-improver, static-analysis, workflow-skill-design, zeroize-audit

Codex User-Level Install

If you want the plugins available user-wide and automatically synced to this repo, use the PowerShell installer:

pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode install

Useful commands:

pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode status
pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode uninstall
pwsh -ExecutionPolicy Bypass -File .\scripts\install-user-level.ps1 -Mode install -Force

-Force backs up conflicting user-level paths to *.backup-YYYYMMDD-HHMMSS before replacing them with junctions.

What it creates:

• %USERPROFILE%\.codex\.agents\plugins -> junction to this repo's .agents\plugins
• %USERPROFILE%\.codex\plugins\<plugin-name> -> junctions to this repo's plugins\<plugin-name>

Why this layout:

• Codex keeps reading the marketplace from the user-level .codex home
• The plugin content stays in this repo as the single source of truth
• Future updates are simple: pull the repo, then restart Codex
• If new plugins are added later, re-run -Mode install

For dry runs or custom targets, override the Codex home: