A skill for managing projects and work packages in OpenProject, a project-management system. It covers tasks, files, dependencies, users, boards, watchers, and notifications through connected tools.

Use it to discover projects, search or inspect work packages, manage assignments and relations, handle attachments, update watchers, and triage notifications.

It helps an agent find and update project work while checking identifiers and handling sensitive or destructive changes carefully. This reduces mistakes when changing shared project data.

openproject — Skill by alex13slem

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/alex13slem/openproject-codex-plugin/openproject

Any agent

npx skills add alex13slem/openproject-codex-plugin --skill openproject

Clone the repo

git clone --depth 1 https://github.com/alex13slem/openproject-codex-plugin

Made for: Claude Code, Codex.

Per session 51 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 594 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00051	$0.00594
Opus 5	$0.00026	$0.00297
Sonnet 5	$0.00010	$0.00119
Haiku 4.5	$0.00005	$0.00059

Measured yesterday against content hash 9a2b291dd5ad, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

openproject scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/openproject/skills/openproject/SKILL.md · 51 lines

How it starts

The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.

OpenProject

Use the openproject MCP tools for OpenProject work.

Safety

Treat project and work-package creation, updates, assignments, relations, watchers, comments, uploads, and notification changes as external writes.
Perform a write only when the user explicitly requests it and the target project or work package is unambiguous.
Treat project, work-package, relation, attachment, and watcher deletion as destructive. Confirm an ambiguous deletion target before calling the tool.
Before a write, resolve project, type, status, priority, and assignee IDs with read tools when needed.
Read only a local attachment path explicitly supplied or clearly identified by the user. Respect size limits and never scan credential directories.
Never expose API tokens or environment-file contents.
After a write, report the affected resource ID and returned OpenProject URL when available.

Workflow

Use list_projects to resolve a project name or identifier.
Use search_work_packages or get_work_package to inspect existing work. Search can be narrowed by project, assignee, exact due date, and either an exact status or the open/closed status category. Use assignedToMe for the authenticated user's work packages.
Prefer count_projects or count_work_packages when only a total is needed. Follow hasMore pagination metadata instead of silently assuming a list is complete.
Resolve write inputs with list_work_package_types, list_work_package_statuses, list_work_package_priorities, list_project_versions, and list_available_assignees.
Use list_work_package_attachments and then get_work_package_attachment when the task includes attached files. Raise maxBytes only when the listed file size requires it.
Use list_work_package_activities for comment and change history, relation tools for dependencies, and watcher tools for subscriptions.
Use create_work_package for new tasks. Omit typeId to select the project's Task type automatically.
Use update_work_package for field changes and add_work_package_comment for progress notes and follow-ups.
Use notification tools for the authenticated user's inbox and board tools for read-only Kanban inspection.
Use get_openproject_api only when no typed read tool covers the needed API v3 resource. It is a GET-only escape hatch, not a substitute for the focused tools.

Read the full file on GitHub · 51 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 51 lines · 51 tokens per session scan A 9a2b291dd5ad

Subscribe to this mod's changes

openproject is a skill published in the GitHub repository alex13slem/openproject-codex-plugin (0 stars, last pushed 1mo ago), licensed MIT. It adds 51 tokens to every session and 594 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Data and AI Planning Research codex codex-plugin mcp openproject

openproject-codex

Use the OpenProject Codex plugin to inspect and manage work in Codex through the OpenProject API.

varaprasadreddy9676/openproject-codex-plugin · 27 tokens

watch

File sentinel that monitors the working directory for changes and marker comments, then auto-triggers appropriate skills. Poll-based via git diff against the last scan commit. Writes intake items for batch processing and routes marker actions through /do. Use for automatic reactions to file changes; do NOT use for…

SethGammon/Citadel · 70 tokens

review

5-pass structured code review — correctness, security, performance, readability, consistency.

SethGammon/Citadel · 17 tokens

live-preview

Mid-build visual verification loop. Takes screenshots of components during construction, not just after. Catches visual regressions and invisible features before they compound. Requires Playwright or similar screenshot tool.

SethGammon/Citadel · 40 tokens

marshal

Meta-orchestrator that takes any direction — broad, specific, or vague — and autonomously chains skills and context into actionable work. Gathers context from codebase, docs, and memory. Only asks the user when it genuinely cannot proceed. Single-session orchestrator.

SethGammon/Citadel · 56 tokens

wiki

Markdown-first knowledge base where the LLM acts as librarian. Ingests raw sources, compiles and interlinks topic files, self-maintains an index. No vector DB or embeddings required -- uses LLM-native navigation over structured markdown up to 400K words.