Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/tony/skills/codexgit clone --depth 1 https://github.com/tony/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/tony/skills/codex)<a href="https://agentmods.dev/agents/tony/skills/codex"><img src="https://agentmods.dev/badge/agents/tony/skills/codex.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02564 |
| Opus 5 | $0.00000 | $0.01282 |
| Sonnet 5 | $0.00000 | $0.00513 |
| Haiku 4.5 | $0.00000 | $0.00256 |
Grade A, and why
codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Adapter: Codex 0.149.0
Validated with two independent Codex processes sharing the default CODEX_HOME.
Upstream: openai/codex, release
rust-v0.149.0,
which introduced codex queue.
1. Identity
- Own address: the thread UUID from
$CODEX_THREAD_ID. - Where exposed: every agent-run command receives
$CODEX_THREAD_ID;/statusalso displays it. - Stability: stable across the observed turn sequence. Resume and restart stability are
UNKNOWNbecause neither was exercised. - Human-readable name:
/rename <name>made the thread immediately resolvable bycodex queue --thread <name>, on both trial threads. Collision behavior isUNKNOWN.
Evidence: T1.A, T1.B, T1.A-receipt.
2. Discovery
Paths below are relative to ${CODEX_HOME:-$HOME/.codex}.
- Enumerate peers: no model-facing peer tool was found. A same-UID helper can join
session_index.jsonlwith held files underthread-writer-locks/;fusersupplies the owning process ID. - Scope: threads sharing a
CODEX_HOME. - What a listing shows: thread UUID and name from the index; liveness and process ID from
the writer lock. Queue depth is readable from
queue_1.sqlite. - Blind spots: Claude sessions never appear. The
codex agentsinteractive UI and app-server discovery were observed only from source and are not the adapter's portable discovery path.
Evidence: T1.C-disc and T1.O-disc.
3. Transports
codex-queue (send and receive)
$ codex queue \
--thread <uuid-or-name> \
--message "$(cat <<'RELAY'
[relay/1 from=A:codex@<thread> to=B id=<id> hop=0 want=none] <body>
RELAY
)"
- Preconditions: the target thread exists in the same
CODEX_HOMEand is not archived. Exact UUIDs and exact names both work. Pass the body through a quoted heredoc as shown; interpolating it into a quoted literal breaks on an apostrophe such asit's done, and the remainder of the message is then read as shell syntax. - Success signal: stdout returns a durable queue-item UUID and the resolved target UUID.
A same-UID helper can verify the row in
queue_1.sqlite. - Daemon requirement: no long-running daemon was needed; a Claude shell invocation used
the CLI's embedded app-server and enqueued in under one second once warm. The first call
against a freshly started thread can block for minutes and enqueue nothing — measured at over
two minutes twice and over four minutes once, the last outliving its own
timeoutand never completing even though the target was discoverable and its writer lock live. Do not retry: a second call double-delivers if the first was merely slow. Pollqueued_itemsfor the item id instead, and if nothing lands, report the transport unreachable rather than falling back to a live-only one. - Failure modes: missing-target, full-queue, and oversize errors are
UNKNOWNempirically.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 221 lines · 0 tokens per session scan A 14c761aa6624
codex is an agent published in the GitHub repository tony/skills (2 stars, last pushed 5d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,564 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
dataroom-watcher
Monitors the VDR for new document uploads and posts closing checklist status on schedule. Flags new uploads that match high-priority categories. Trigger: "what's new in the data room", "VDR updates", or on schedule.
maid-manifest-architect
MAID Phase 1 - Create and validate manifest from user's goal.
maid-test-designer
MAID Phase 2 - Create behavioral tests that USE artifacts from manifest.
maid-auditor
MAID Compliance Auditor - Enforce methodology compliance across all phases.
stakeholder-researcher
Research one stakeholder from the public record when no LinkedIn PDF is available, for a high-stakes meeting brief. Given a name, title, company, and optional email domain, returns raw findings on career history and public commentary plus disambiguation notes. Used by the job-interview-meeting-preparation skill on the…
launch-watcher
Monitors the launch tracker (Jira/Linear) for upcoming launches that likely need UK legal review, flags them before product counsel gets surprised. Runs daily. Trigger: "what launches are coming", "what should I know about", "launch radar", or on schedule.