Borrowing it
Nothing to install: this file belongs to dzhng/duet-agent. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dzhng/duet-agent/main/.agents/skills/codex/SKILL.mdgit clone --depth 1 https://github.com/dzhng/duet-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dzhng/duet-agent/codex)<a href="https://agentmods.dev/skills/dzhng/duet-agent/codex"><img src="https://agentmods.dev/badge/skills/dzhng/duet-agent/codex/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dzhng/duet-agent/codex"><img src="https://agentmods.dev/badge/skills/dzhng/duet-agent/codex.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.02458 |
| Opus 5.5 | $0.00033 | $0.00983 |
| Sonnet 5.5 | $0.00016 | $0.00492 |
| Haiku 4.5 | $0.00008 | $0.00246 |
Grade D, and why
codex scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
unlike `"$(cat prompt.txt)"`, which silently sends the fallback string as Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`grep -rl "<marker>" ~/.codex/sessions/<Y/M/D>/` finds no session within This is a copy
98% identical to codex — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex
Codex is an independent agent on PATH (codex — invoke as command codex if
a shell alias shadows it), sharing this working tree and already authenticated. It is a second opinion, not ground truth: verify what it
reports, own what it changes. It reads the same skills your repo carries.
Leave Codex's model at its CLI default unless the user asks for a specific
one. The default follows the current Codex release; do not pin a dated model
ID in this skill. If an explicit override is needed, verify it is current and
pass the requested model with -m <model>.
If codex is not installed
When codex is missing from PATH, offer to install it — ask the user for
approval first, never install on your own initiative. On yes, follow the
current instructions at https://developers.openai.com/codex/cli. First-run
authentication is interactive — hand that step to the user. Verify with
codex --version before proceeding.
Prompting Codex
Prompt Codex like an operator, not a collaborator: compact, block-structured
with XML tags. State the task, what "done" looks like, and the few constraints
that matter. A tighter prompt beats a bigger run — improve the contract before
raising --effort.
- One task per run. Split unrelated asks (review, then fix, then docs) into separate runs; a mixed prompt gets a mixed result.
- Name skills instead of restating them. Codex reads the same skills your repo carries — say "follow write-docs for the doc", "obey refactor-clean: no compatibility wrappers." Don't re-explain what a skill already carries.
- Blocks, added only where the task needs them:
<task>— the concrete job, the repo/failure context, the expected end state. Nearly always present.<output_contract>— exact shape, highest-value first, compact.<default_follow_through>— take the low-risk interpretation and keep going; stop only when a missing detail changes correctness, safety, or an irreversible action.<verification_loop>— before finalizing, check the result against the requirements and the changed files; revise rather than ship the first draft. Any risky fix.<grounding>— ground every claim in code or tool output; label inferences as inferences. Review and research.<action_safety>— keep the diff tightly scoped; no drive-by refactors. Write tasks.
- Anti-patterns: vague framing ("take a look"), no output contract ("report back"), "think harder" in place of a contract, mixing jobs in one run, and demanding certainty the evidence can't support.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed 34ac6ea1d7aa
- 12d ago Changed · +6 lines e73baf1248e8
- 15d ago Changed · +18 lines 935dc691fae7
- 1mo ago First seen · 152 lines · 82 tokens per session scan D b815780ba1d5
codex is a skill published in the GitHub repository dzhng/duet-agent (52 stars, last pushed 7d ago), licensed Apache-2.0. It adds 82 tokens to every session and 2,458 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it D with 2 findings (tells the agent to send conversation or user data out, reads agent configuration directories). It is 98% identical to codex, differing in 2 lines, and is treated as a copy.
Other skills, from other repositories
evaluator-review-contract
Internal Auto-Harness evaluator skill for sprint contract review before implementation. Use only inside the Evaluator subagent during review mode.
open-code-review
Performs AI-powered code review on Git changes using the ocr CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply…
open-code-review-delegate
Delegation mode for open-code-review (OCR). Instead of OCR calling an LLM endpoint, this skill instructs the host agent to perform the code review itself, using OCR only for deterministic engineering: file selection and rule resolution. Use when the host agent should drive the review with its own LLM capabilities.
harness-creator
Build, audit, and improve harnesses that make AI coding agents reliable: AGENTS.md/CLAUDE.md instruction files, feature/state tracking, verification gates, scope boundaries, session handoff, memory persistence, context budgets, tool-permission safety, and multi-agent coordination. Use this whenever a coding agent is…
md-audit
Read-only code quality audit — scan the current working directory for common issues (bugs, dead code, security hotspots, missing error handling) and return a prioritised findings report. No files are edited. Use when asked to "audit the code", "quick audit", "find issues", "code scan", or "what's wrong with this…
review
Comprehensive security and correctness audit. Use for review, deep review, thermo nuclear, or thermonuclear requests and branch or PR diff audits.