Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add boringmarketer/kimi-first --skill codex-firstgit clone --depth 1 https://github.com/boringmarketer/kimi-firstWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boringmarketer/kimi-first/codex-first)<a href="https://agentmods.dev/skills/boringmarketer/kimi-first/codex-first"><img src="https://agentmods.dev/badge/skills/boringmarketer/kimi-first/codex-first/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boringmarketer/kimi-first/codex-first"><img src="https://agentmods.dev/badge/skills/boringmarketer/kimi-first/codex-first.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.01389 |
| Opus 5.5 | $0.00026 | $0.00556 |
| Sonnet 5.5 | $0.00013 | $0.00278 |
| Haiku 4.5 | $0.00006 | $0.00139 |
Grade C, and why
codex-first scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- PRUNE worktrees after each lane lands: `rm -rf /private/tmp/<repo>-*` + `git worktree prune` How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex First
Claude Code sessions only. Rationale: GPT-5.6 lanes run flat-rate on the ChatGPT plan and top the coding index; Fable's edge is judgment, specs, orchestration, review. Codex types, Claude thinks and verifies. (Adapted from steipete/agent-scripts for James's rig.)
Route
Delegate to Codex (default for hands-on volume):
- implementation from a frozen spec; refactors; mechanical migrations/sweeps
- bug fixes with a known repro; test writing; coverage fills
- CI fixes, dependency bumps, scripts/tooling
- bulk exploration where raw reading ≫ the answer
Keep in Claude (never delegate):
- design, architecture, naming, product judgment — tasks where writing the spec IS the work
- tiny edits (<~20 lines, single obvious change) — delegation overhead loses
- anything needing session tools: MCP, browser, PostHog, memory
- prod operations, always: prod DB (psql), Railway env/deploys, Stripe, DNS, customer
emails, anything reading
.env/secrets. Codex never touches prod credentials or runs with them in reach. - destructive/irreversible ops, releases, pushes, merges — Claude-side per repo protocol
- review of Codex output — never delegated, never skipped
Heuristic: prompt reads as a work order → delegate; writing it forces decisions → design, keep it. Mixed task: Claude designs, freezes spec, delegates build-out.
Model/effort routing (updated Aug 26 — James's strategic-loop topology)
- IMPLEMENTATION lanes:
gpt-5.6-terra, effort ultra — big, BOLD, atomic work orders (whole migrations, whole screens, whole adapters). Clear frozen spec in, commits out. Claude reviews at the seams, not over the shoulder. - REVIEWER / THINKING PARTNER:
gpt-5.6-sol, effort high→max→ultra — adversarial passes, certification reads, design attacks, strategy pressure-tests. Sol is no longer escalation-only; it is the standing second brain in loops (build: terra → attack: sol → synthesize: Claude). - Routine/cheap orders:
gpt-5.6-luna, effort high. When the 5.6 weekly limit is out,gpt-5.3-codex-sparkruns on a SEPARATE quota — use it for routine/mechanical lanes only; judgment and class-1 review stay on Claude seats. - Opus 5 subagents (via Claude's Agent tool): completeness reads, design rulings, funnel/product craft — the divergent-thinking seat in loops.
- NAMED SEATS (Sep 1,
~/.claude/agents/, load at session start):designer(Opus xhigh, gating design verdict),completeness-reader(Opus xhigh, scope/journey/doc-truth + overengineering strip list, before any merge or "live" claim),explorer(Sonnet low, read-only sweeps — file dumps never enter Fable's context),verifier(Sonnet xhigh, browser/MCP/walkthrough films with evidence, never verdicts). Fable keeps: WO authoring, prod ops, merges, final gate. Hands-on reading in the Fable seat is the priciest seat doing the cheapest work — delegate it. Skip Haiku (200K, a generation back). - Escalate effort on failure; choose SEAT by role (terra builds, sol attacks, opus designs, Claude gates + synthesizes + ships).
- Every lane must COMMIT its work (atomic commits per tripwire/feature); Claude verifies commits exist + runs the repo's own proof set before any merge (for TS repos typically: lint, typecheck, unit tests, build, plus any disposable-infra verifier the repo carries).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 77052fc44fa4
- 1mo ago First seen · 96 lines · 65 tokens per session scan C b8798db17a49
codex-first is a skill published in the GitHub repository boringmarketer/kimi-first (49 stars, last pushed 1mo ago), licensed MIT. It adds 65 tokens to every session and 1,389 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
deepseek-and-destroy
Continuously execute a complex multi-phase implementation plan through configurable worker-agent loops until the plan is complete or a genuinely human-level blocker is reached. Uses fresh implementation and review contexts, reviewer-led repair, fresh re-review, durable multi-orchestrator state, and main-orchestrator…
systematic-bug-hunting
Use when actually hunting for exploitable bugs at the bench inside an already-authorized engagement — reading a target, running scanners/fuzzers, sitting on a pile of odd-but-inert observations, tempted to report something "probably exploitable", or about to conclude "nothing found". Applies to every target class…
systematic-attacking
Use for ALL authorized offensive-security / bug-bounty work — the single method to find, chain, prove, dedup, and package the highest-value (High/Critical) findings across every domain (web/SaaS, smart-contract/DeFi, infra/cloud, LLM/AI, mobile, binary/firmware). Enforces two iron laws before any offensive action or…
defi-invariant-check
Use when the audit target is a DeFi protocol — AMM, lending market, yield vault, stablecoin, or perps — and you must author the economic properties generic campaigns miss, such as token-conservation, constant-product k, share accounting, collateralization, and oracle-deviation invariants, then falsify them.
vulnhunter-solana
Use when reviewing Solana program code for the account-model bug classes — unchecked account owner, absent signer, discriminator confusion, caller-controlled CPI seeds, PDA-derivation collision, SPL arithmetic overflow, close-and-reinitialize revival, and duplicate-account aliasing — the pattern census that stands in…
rule8-truth-gate
Use at S4 before an investigation, article, campaign, narration, or screen production with external-world assertions may advance: require returned source bundles, enforce the requested recency interval for every decision-critical premise, reject unmapped items, and emit the mandated PASS/needstool truth record.