Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/barkaaa/codex-gate/codex-reviewnpx skills add barkaaa/codex-gate --skill codex-reviewgit clone --depth 1 https://github.com/barkaaa/codex-gateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.01742 |
| Opus 5 | $0.00039 | $0.00871 |
| Sonnet 5 | $0.00016 | $0.00348 |
| Haiku 4.5 | $0.00008 | $0.00174 |
Grade A, and why
codex-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
codex-review
Codex is a real, independent reviewer reached via the codex CLI. Do not
fake this — actually run the commands below and read Codex's real output.
Plan directory
The plan directory is configurable per project via the CODEX_REVIEW_PLAN_DIR
env var set in this project's .claude/settings.json Stop hook command
(defaults to plans if unset — check that file to confirm the actual
value for this project). All references to "the plan directory" below
mean that directory, not necessarily a literal plans/.
Codex CLI facts (probed 2026-06-30, codex-cli 0.140.0)
- Non-interactive entrypoint:
codex exec. Without a subcommand it reads the prompt from the argument (or stdin if-/ no arg given). - Always redirect stdin from
/dev/nullwhen scripting this — even with a prompt argument, codex still tries to read stdin and will hang forever if stdin is left attached to a pipe/terminal that never closes. - Always pass
--skip-git-repo-checkif the plan's directory isn't guaranteed to be a git repo. -C <dir>sets the working root codex operates in — use the current project root ($CLAUDE_PROJECT_DIR), not the script's own directory.--jsonstreams JSONL events to stdout. The first line is{"type":"thread.started","thread_id":"<uuid>"}— this uuid is the session id to save for resume.-o <file>writes just the final agent message (clean text, no JSON) to<file>. Prefer this over parsing the JSONL stream for the "what did Codex actually say" content.- To continue the same session:
codex exec resume <thread_id> -o <file> --json "<prompt>" < /dev/null. Verified: token usage grows across calls and Codex correctly recalls prior-turn content, so this is genuine context reuse, not a fresh thread. codex exec resumedoes not accept-C— only the initialcodex execcall takes-C <dir>. Passing-Ctoresumefails witherror: unexpected argument '-C' found(exit code 2). The resumed thread already runs in whatever directory the session started in.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 142 lines · 79 tokens per session scan A ce10599e647f
codex-review is a skill published in the GitHub repository barkaaa/codex-gate (2 stars, last pushed 1mo ago), licensed MIT. It adds 79 tokens to every session and 1,742 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
decision-ledger
Maintain an append-only decision ledger (DECISIONS.md). Use when the user confirms a decision, reverses or changes a past decision, asks what was decided and why, or at session start to load standing decisions.
webmcp-setup
Bootstraps webmcp-react into an existing React or Next.js app. Installs dependencies, adds WebMCPProvider, creates a first tool, and configures the MCP client bridge. Use when the user wants to set up WebMCP, add MCP tools to their app, integrate webmcp-react, or make their React app accessible to AI agents.
goal
Run a large or unfamiliar goal through the full ballast pipeline — mobilize what you already hold, terrain scan, full skeleton, atomic foundation learning with verification, then build from bedrock to a verified done. Use when the user hands over a big goal, enters a new field, or asks to learn X in order to achieve Y.
skill-forge
Promote a procedure that was worked out end-to-end and verified into a reusable skill file, so the next similar task starts from the solved path. Use when a hard-won procedure succeeds with evidence, when the same multi-step task appears a second time, or when the user says "make this repeatable".
report
Read the delivery log and say which rules actually fire, which never have, and what to prune or fix. Use when the user asks whether ballast is doing anything, wants to clean up their rule catalog, or on a periodic review.
config-manager
Skill that manages configuration.