Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/catalystsystemslab/codex-skill-sync/skill-syncnpx skills add catalystsystemslab/codex-skill-sync --skill skill-syncgit clone --depth 1 https://github.com/catalystsystemslab/codex-skill-syncWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00052 | $0.01376 |
| Opus 5 | $0.00026 | $0.00688 |
| Sonnet 5 | $0.00010 | $0.00275 |
| Haiku 4.5 | $0.00005 | $0.00138 |
Grade A, and why
skill-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Sync
Source: https://github.com/catalystsystemslab/codex-skill-sync/tree/main/skill-sync
Keep installed skills and Codex plugins current. doctor is read-only setup
diagnostics. check, update, and run all all start the same inventory and
mapping flow.
Language
Reply in the user's language by default.
- If the user writes in English, respond in English.
- If the user writes in Chinese, respond in Simplified Chinese.
- If the user mixes English and Chinese, use the dominant language.
- Keep commands, file paths, JSON keys, status values, and shell commands unchanged.
- Translate explanations, summaries, warnings, and recommendations.
Important label translations:
- Official / 官方
- Community / 社区
- Needs Setup / 需要设置
current/ 已是最新update_available/ 有可用更新updated/ 已更新skipped/ 已跳过failed/ 失败
Start Here
For check, update, and run all, first list what is installed:
python3 <skill-dir>/scripts/update_codex_assets.py --inventory --json --report skill-update-report.json
Show the result as three groups. Translate internal JSON groups this way:
official-> Officialnon_official-> Communityunmapped-> Needs Setup
Blank repo means the source is not confirmed. Do not guess.
Beginner Response Style
Most users do not know Git, JSON, branches, or subpaths.
When showing inventory:
- Explain each group in plain language.
- Do not show raw JSON unless the user asks.
- Recommend the safest next action.
- Ask one decision at a time.
When mapping:
- Say that public GitHub search may use the skill name and description.
- Never ask the user to edit JSON manually unless they choose advanced mode.
- If editing the manifest, preserve existing entries and only add confirmed mappings.
- Show exactly what will be saved before saving it.
Before apply:
- Summarize what will change.
- List skipped skills separately.
- Remind the user that backups will be created.
- Ask for explicit confirmation.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 180 lines · 52 tokens per session scan A 84b3a45c4424
skill-sync is a skill published in the GitHub repository catalystsystemslab/codex-skill-sync (2 stars, last pushed 2mo ago), licensed MIT. It adds 52 tokens to every session and 1,376 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
context-canvas-reflection
Run one bounded trajectory reflection when repeated same-cause failures, contradicted assumptions, real-use failure after local green, material scope drift, a materially unresolved phase boundary, an unapproved authority-sensitive next effect, or user doubt suggests the current path may be wrong. Use Context Canvas…
context-canvas-checkpoint
Maintain an optional session task map and explicit retrievable references in Context Canvas Codex. Use when navigation or long-context offload would materially help with goals, decisions, progress, dependencies, blockers, next steps, exploration summaries, large textual tool results, or selective historical…
operate-a2a-superhub
Operate and diagnose the A2A Superhub product across its CLI, HTTP, and declared MCP/A2A surfaces. Use when the user explicitly asks to inspect a Superhub, create or read Superhub tasks or artifacts, work with Superhub memory/inbox/wakeup/handoffs, validate this product skill, diagnose auth/index/queue/capability…
adversarial-review
Send a fresh-context agent to check every claim in the given documents (or the documents in the current diff) against the code and the real environment, and report graded findings. Required before committing any significant document change — a new document, a rewritten section, an outward-facing README or…
align-scope
Turn a vague direction into a settled scope before any work starts — one question at a time, facts checked by you, decisions left to the human. Run it when the ask is broad, ambiguous, or would be expensive to get wrong; skip it when the next step is obvious.
handoff-check
Confirm a fresh conversation could pick this project up from the documents alone — the procedure is in the body. Run it when the user says "check the project docs so it can be handed over" or "are we handover-ready?", or when a stretch of work ends and you want the handoff proven rather than assumed.