Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bahayonghang/my-ai-cli-toolkit/codex-bridgenpx skills add bahayonghang/my-ai-cli-toolkit --skill codex-bridgegit clone --depth 1 https://github.com/bahayonghang/my-ai-cli-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/codex-bridge)<a href="https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/codex-bridge"><img src="https://agentmods.dev/badge/skills/bahayonghang/my-ai-cli-toolkit/codex-bridge.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00102 | $0.00884 |
| Opus 5 | $0.00051 | $0.00442 |
| Sonnet 5 | $0.00020 | $0.00177 |
| Haiku 4.5 | $0.00010 | $0.00088 |
Grade A, and why
codex-bridge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Bridge
Package context, run Codex with a fixed sandbox, validate its response, and synthesize verified findings.
Replace
<skill-dir>with this skill's literal directory. On Windows,py -3may replacepython.
Scenarios
| Scenario | Purpose | Sandbox | Default model |
|---|---|---|---|
plan-review |
Review an explicit plan | read-only |
gpt-5.6-sol |
codify |
Implement approved work | workspace-write |
gpt-5.6-sol |
review-iteration |
Apply focused review; round 2 is final | workspace-write |
gpt-5.6-terra |
verification-round |
Verify extrapolated instances | read-only |
gpt-5.6-sol |
Sandbox is code-owned. Only model and effort accept project or CLI overrides.
Workflow
- Confirm explicit Codex intent and select one scenario.
- Create a round:
python "<skill-dir>/scripts/create_bundle.py" <scenario> "<project-root>". - Distill decisions, rejected approaches, unknowns, and session provenance into
conversation.md. - Copy required sources into
files/as afile-backed fixture. - Fill every placeholder in
request.md. Do not omit referenced plans, conventions, or reviewed files. - Set manifest session, previous-round, and verification-purpose fields.
- Run
python "<skill-dir>/scripts/validate_bundle.py" "<bundle>" --phase preflight; fix every failure. - For workspace-write, preserve unrelated changes and enforce the authorized scope.
- Run
python "<skill-dir>/scripts/run_bundle.py" "<bundle>". Add--output-schemaonly when the active Codex endpoint supports protocol-level schema validation. - Run
python "<skill-dir>/scripts/validate_bundle.py" "<bundle>" --phase post-response. - Compare
files_changedwith the working tree; synthesize accepted, rejected, and uncertain points. - Record pattern extraction; verify only concrete lateral candidates. Never recurse or create round 3.
Read workflow detail, bundle conventions, and the scenario prompt-notes.md before filling a bundle. Use checklist.md before execution and jsonl-guide.md when locating source conversations. Routing review cases live under evals/ and load only for route evaluation.
What ships with it
30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/interface.yaml 970 B
- checklist.md 1.5 KB
- conventions.md 1.6 KB
- evals/evals.json 3.2 KB
- jsonl-guide.md 1.2 KB
- models.json 703 B
- references/workflow-detail.md 3.9 KB
- reports/output_quality_scorecard.md 1.5 KB
- reports/trust-report.json 7.8 KB
- reports/trust-report.md 2.1 KB
- scripts/bundle_common.py 2.0 KB runs code
- scripts/create_bundle.py 8.0 KB runs code
- scripts/run_bundle.py 5.8 KB runs code
- scripts/validate_bundle.py 16 KB runs code
- security/permission_policy.json 1.6 KB
- templates/codify/prompt-notes.md 1.5 KB
- templates/codify/request.md 1.7 KB
- templates/codify/response.schema.json 2.5 KB
- templates/plan-review/prompt-notes.md 1.5 KB
- templates/plan-review/request.md 1.9 KB
- templates/plan-review/response.schema.json 2.7 KB
- templates/review-iteration/prompt-notes.md 1.0 KB
- templates/review-iteration/request.md 1.8 KB
- templates/review-iteration/response.schema.json 2.7 KB
- templates/verification-round/prompt-notes.md 1.6 KB
- templates/verification-round/request.md 1.6 KB
- templates/verification-round/response.schema.json 1.7 KB
- tests/bundle-scripts.test.mjs 15 KB runs code
- tests/traceability.md 3.3 KB
- THIRD_PARTY_NOTICES.md 1.7 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 61 lines · 102 tokens per session scan A 9a80c1b19f6c
codex-bridge is a skill published in the GitHub repository bahayonghang/my-ai-cli-toolkit (16 stars, last pushed 2d ago), licensed MIT. It adds 102 tokens to every session and 884 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bridge-pattern-implementor
Implement the Bridge pattern to decouple an abstraction from its implementation so both can vary independently. Use when you want to avoid a permanent binding between abstraction and implementation, when both abstractions and implementations should be extensible by subclassing, when implementation changes should not…
collaboration-proposal-writer
Writes a structured proposal for a co-production, editorial partnership, or cross-platform collaboration between two or more media organisations, clearly articulating the mutual benefit and division of responsibilities.
algorithmic-art
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright…
git-commit
Generate well-formatted git commit messages following conventional commit standards.
gitnexus-impact-analysis
Use when the user wants to know what will break if they change something, or needs safety analysis before editing code. Examples: "Is it safe to change X?", "What depends on this?", "What will break?".
doc-coauthoring
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers.…