Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bytefer/geo-seo-codex --skill geo-updategit clone --depth 1 https://github.com/bytefer/geo-seo-codexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bytefer/geo-seo-codex/geo-update)<a href="https://agentmods.dev/skills/bytefer/geo-seo-codex/geo-update"><img src="https://agentmods.dev/badge/skills/bytefer/geo-seo-codex/geo-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01447 |
| Opus 5 | $0.00022 | $0.00724 |
| Sonnet 5 | $0.00009 | $0.00289 |
| Haiku 4.5 | $0.00004 | $0.00145 |
Grade D, and why
geo-update scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **Never modify `~/.codex/config.toml` or other user Codex configuration files** — these are user configuration files, not part of the GEO-SEO toolkit. Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$TEMP_DIR" How it starts
The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GEO-SEO Update Skill
Purpose
Updates the locally installed GEO-SEO skills, agents, scripts, and schema templates to the latest version from the upstream repository. Shows a summary of what changed before and after the update.
Update Workflow
Step 1: Determine Installed Location
The GEO-SEO toolkit installs to these locations under ~/.codex/:
| Component | Install Path |
|---|---|
| Main skill | ~/.codex/skills/geo/ |
| Sub-skills | ~/.codex/skills/geo-*/ |
| Agents | ~/.codex/agents/geo-*.toml |
| Scripts | ~/.codex/skills/geo/scripts/ |
| Schema templates | ~/.codex/skills/geo/schema/ |
| Hooks | ~/.codex/skills/geo/hooks/ |
Verify the installation exists by checking for ~/.codex/skills/geo/SKILL.md. If it does not exist, inform the user that GEO-SEO is not installed and suggest running the installer instead.
Step 2: Clone Latest from Upstream
TEMP_DIR=$(mktemp -d)
git clone --depth 1 https://github.com/bytefer/geo-seo-codex.git "$TEMP_DIR/repo"
If the clone fails, report the error and stop. Do not modify any installed files.
Step 3: Compare Installed vs Latest
Before copying files, generate a diff summary so the user knows what will change:
- For each component directory, compare the installed files against the cloned files using
diff --recursive --brief. - Categorise changes as:
- New files — exist in upstream but not locally
- Modified files — exist in both but differ
- Removed files — exist locally but not in upstream (these are NOT deleted automatically)
- Present the summary to the user.
Step 4: Apply Updates
Copy files from the cloned repo over the installed locations:
CODEX_DIR="${CODEX_HOME:-${HOME}/.codex}"
SKILLS_DIR="${CODEX_SKILLS_DIR:-${CODEX_DIR}/skills}"
AGENTS_DIR="${CODEX_AGENTS_DIR:-${CODEX_DIR}/agents}"
INSTALL_DIR="${SKILLS_DIR}/geo"
VENV_DIR="${INSTALL_DIR}/.venv"
VENV_PY="${VENV_DIR}/bin/python"
SOURCE_DIR="$TEMP_DIR/repo"
# Main skill
mkdir -p "$INSTALL_DIR"
cp -R "$SOURCE_DIR/skills/geo/." "$INSTALL_DIR/"
# Sub-skills
for skill_dir in "$SOURCE_DIR/skills"/*/; do
skill_name=$(basename "$skill_dir")
[ "$skill_name" = "geo" ] && continue
mkdir -p "$SKILLS_DIR/${skill_name}"
cp -R "$skill_dir/." "$SKILLS_DIR/${skill_name}/"
done
# Agents
mkdir -p "$AGENTS_DIR"
for agent_file in "$SOURCE_DIR/agents/"*.toml; do
[ -f "$agent_file" ] || continue
cp "$agent_file" "$AGENTS_DIR/"
done
# Scripts
if [ -d "$SOURCE_DIR/scripts" ]; then
mkdir -p "$INSTALL_DIR/scripts"
cp -R "$SOURCE_DIR/scripts/." "$INSTALL_DIR/scripts/"
chmod +x "$INSTALL_DIR/scripts/"*.py "$INSTALL_DIR/scripts/webapp/"*.py 2>/dev/null || true
fi
# Schema templates
if [ -d "$SOURCE_DIR/schema" ]; then
mkdir -p "$INSTALL_DIR/schema"
cp -R "$SOURCE_DIR/schema/." "$INSTALL_DIR/schema/"
fi
# Report templates
if [ -d "$SOURCE_DIR/templates" ]; then
mkdir -p "$INSTALL_DIR/templates"
cp -R "$SOURCE_DIR/templates/." "$INSTALL_DIR/templates/"
fi
# White-label support files
if [ -d "$SOURCE_DIR/white-label" ]; then
mkdir -p "$INSTALL_DIR/white-label"
cp -R "$SOURCE_DIR/white-label/." "$INSTALL_DIR/white-label/"
fi
# Hooks
if [ -d "$SOURCE_DIR/hooks" ] && [ "$(ls -A "$SOURCE_DIR/hooks" 2>/dev/null)" ]; then
mkdir -p "$INSTALL_DIR/hooks"
cp -R "$SOURCE_DIR/hooks/." "$INSTALL_DIR/hooks/"
chmod +x "$INSTALL_DIR/hooks/"* 2>/dev/null || true
fi
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 169 lines · 44 tokens per session scan D fc60cf53cf3f
geo-update is a skill published in the GitHub repository bytefer/geo-seo-codex (11 stars, last pushed 2mo ago), licensed MIT. It adds 44 tokens to every session and 1,447 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
building-edgespark-apps
Build and modify EdgeSpark apps. Use when a project has edgespark.toml, the user mentions EdgeSpark, or work involves the edgespark CLI, server SDK types, storage/auth/database workflows, deployment, or @edgespark/web.
edgespark-frontend-design
Design and redesign EdgeSpark frontends with distinctive, production-grade visual direction instead of generic AI-looking UI. Use when building or polishing landing pages, marketing sites, dashboards, auth flows, portfolios, product surfaces, or reusable frontend sections in EdgeSpark, especially when the task…
ppt-design-skill
Design, generate, review, and revise editable PowerPoint presentations through a rigorous brief-to-PNG workflow using the public pptx-designer Python library.
execute
Dispatch and execute implementation plans with TDD and checkpoints. Use when plan is ready. Parallel by default for independent tasks.
flutter-ui
Build Flutter UI from Figma MCP or image input. Scans src for design tokens (colors, sizes, text styles), existing components, and naming conventions before writing a single line of code. Never hard-codes values.
serena
Serena code intelligence — LSP-powered symbol navigation, diagnostics, and targeted code surgery. Activate before complex refactors, cross-file analysis, or when graph tools need symbol-level depth.