Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add daffy0208/ai-dev-standards --skill codex-review-workflowgit clone --depth 1 https://github.com/daffy0208/ai-dev-standardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/daffy0208/ai-dev-standards/codex-review-workflow)<a href="https://agentmods.dev/skills/daffy0208/ai-dev-standards/codex-review-workflow"><img src="https://agentmods.dev/badge/skills/daffy0208/ai-dev-standards/codex-review-workflow.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02740 |
| Opus 5 | $0.00026 | $0.01370 |
| Sonnet 5 | $0.00011 | $0.00548 |
| Haiku 4.5 | $0.00005 | $0.00274 |
Grade A, and why
codex-review-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 371 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Review Workflow
Overview
Automated code review workflow using OpenAI Codex CLI. Implements iterative fix-and-review cycles to ensure code quality through automated validation.
Use when: Building features that require automated code review, iterative refinement cycles, or validation against specific quality standards using Codex CLI.
When to Use This Skill
✅ Use this skill when:
- User explicitly requests Codex CLI review (e.g., "Review this with Codex")
- Implementing features that require automated code validation
- Building code that must meet specific quality standards
- Iterative review and refinement is needed
- Validating security, bugs, and best practices automatically
❌ Skip this skill when:
- User only wants manual code review
- Codex CLI is not available in the environment
- Task is purely exploratory or research-based
- Simple code that doesn't require formal review
Prerequisites
- Codex CLI installed and available on PATH
- Git repository (or use
--skip-git-repo-checkflag) - Verify installation:
codex --version
Core Workflow
This skill follows a structured 6-step process:
1. Complete the Coding Task
Implement the user's requested feature using standard best practices. Ensure code is well-structured before submitting for review.
Track progress with TodoWrite:
- Implement the requested feature/fix
- Run initial Codex CLI review
- Fix issues found in review (if any)
- Run final Codex CLI review
- Report final status
2. Run Initial Codex CLI Review
Git requirement: Codex CLI requires a git repository. If not in a git repo, run git init first, or use --skip-git-repo-check flag (not recommended for production).
Execute Codex CLI review using codex exec (NOT codex review):
# For a specific file
codex exec "Review the code in <file_name> for bugs, security issues, best practices, and potential improvements. Provide specific, actionable feedback with line numbers and examples."
# For multiple files
codex exec "Review the files auth.py, user.py, and session.py for bugs, security issues, best practices, and potential improvements. Provide specific feedback for each file."
# With working directory context
codex exec "Review the code in email_validator.py for bugs, security issues, best practices, and potential improvements. Provide specific feedback." -C /path/to/project
# With specific model
codex exec "Review <file_name>..." -m gpt-5-codex
# With custom configuration
codex exec "Review <file_name>..." -c model="o3"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 371 lines · 53 tokens per session scan A 48df13af1d66
codex-review-workflow is a skill published in the GitHub repository daffy0208/ai-dev-standards (36 stars, last pushed 8mo ago), licensed MIT. It adds 53 tokens to every session and 2,740 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audit
Use when the user wants a code review on recent changes — quality, spec, security, or performance feedback. Triggers a multi-level (L1-L5) review with a standalone Reviewer; on NEEDSFIX, offers to apply findings via /hyperflow:plan. Trigger with /hyperflow:audit, "review this change", "review my PR", "audit the diff"…
dotnet-best-practices
Ensure .NET/C# code follows maintainable, modern best practices. Use when reviewing or improving C# code, solution structure, async patterns, dependency injection, or testability.
coding
Use when five specialized coding agents (linter, perf, refactor, security, test) that enforce quality gates across the development lifecycle. From lint enforcement through performance profiling, refactoring, security auditing, and test coverage. Use when working with coding agents.
dev-loop
Research → Execute → Dual-Review Loop (Code Quality + Issue Resolution) bis beide Reviews bestanden.
critical-review
Radical-honesty architectural review — questions code, methodology, design, and operational fitness.
review-loop
Iterative code review — fix P1+P2 until clean, report P3 as an offer.