Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Haohao-end/openagentnpx agentmods add skills/haohao-end/openagent/migrate-to-codexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/haohao-end/openagent/migrate-to-codex)<a href="https://agentmods.dev/skills/haohao-end/openagent/migrate-to-codex"><img src="https://agentmods.dev/badge/skills/haohao-end/openagent/migrate-to-codex.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01915 |
| Opus 5 | $0.00014 | $0.00958 |
| Sonnet 5 | $0.00006 | $0.00383 |
| Haiku 4.5 | $0.00003 | $0.00192 |
Grade C, and why
migrate-to-codex scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Keep going until the selected migration is completely done: run the migrator, inspect the report, fix migrated Codex instructions/skills/agents/MCP config, and re-run checks without stopping to ask for confirmation of th Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
Keep going until the selected migration is completely done: run the migrator, inspect the report, fix migrated Codex instructions/skills/agents/MCP config, and re-run checks without stopping to ask for confirmation of th How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migrate to Codex
Autonomy
Keep going until the selected migration is completely done: run the migrator, inspect the report, fix migrated Codex instructions/skills/agents/MCP config, and re-run checks without stopping to ask for confirmation of the next step. If the user has selected a target, do not ask before creating, editing, replacing, or deleting generated Codex artifacts in that target (AGENTS.md, .codex/, .agents/, or ~/.codex/). Preserve unrelated existing Codex config entries in .codex/config.toml or ~/.codex/config.toml, such as notify, projects, marketplaces, or unrelated MCP servers; do not ask about them unless they fail validation or directly conflict with the migration. Do not edit source Claude Code files (.claude/, ~/.claude/, .mcp.json, or .claude.json), unrelated project code, secrets, or another repository.
Migration Order
Run the migration in this order for each selected global or project source:
-
Start by using Codex's built-in TODO/task list tool. Do not create
MIGRATION_TODOS.mdor any TODO file unless the user explicitly asks. The TODO list input has aplanarray whose items each havestepandstatus; use statusespending,in_progress, andcompleted. Make the TODOs specific to the selected artifacts. Before finishing, update the TODO list so every finished step is markedcompletedand no step remainsin_progress. Use literal source → Codex target labels, for example:- Inspect
.claude/commands→ Codex skills/prompts - Inspect
.claude/agents→.codex/agents - Inspect
.mcp.json→.codex/config.tomlMCP servers - Inspect
.claude/settings.jsonhooks →.codex/hooks.json - Migrate safe selected artifacts → Codex files
- Validate generated
.codex/config.toml - Validate generated
.codex/agents - Report migrated artifacts and manual-review items
- Inspect
-
Read
references/differences.md(and refresh Codex docs if itsDocs last checkeddate is old). -
Scan and inspect before writing:
--scan-onlylists active and inactive source surfaces.--planprints staged Codex artifact paths and report rows.--doctorsummarizes readiness, manual-review work, and validation risks.
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 144 B
- LICENSE.txt 11 KB
- manifest.yaml 435 B
- scripts/cli.py 29 KB runs code
- scripts/migrate-to-codex.py 208 B runs code
- scripts/migrate/__init__.py 285 B runs code
- scripts/migrate/agents.py 9.8 KB runs code
- scripts/migrate/codex_config.py 3.9 KB runs code
- scripts/migrate/common.py 11 KB runs code
- scripts/migrate/hooks.py 8.0 KB runs code
- scripts/migrate/instructions.py 2.4 KB runs code
- scripts/migrate/mcps.py 6.9 KB runs code
- scripts/migrate/plugins.py 660 B runs code
- scripts/migrate/settings.py 1.0 KB runs code
- scripts/migrate/skills.py 12 KB runs code
- scripts/utils/__init__.py 35 B runs code
- scripts/utils/scan.py 4.3 KB runs code
- scripts/utils/util.py 9.2 KB runs code
- skill.md 476 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 115 lines · 28 tokens per session scan C 145b7fe48360
migrate-to-codex is a skill published in the GitHub repository Haohao-end/openagent (806 stars, last pushed 1mo ago), licensed MIT. It adds 28 tokens to every session and 1,915 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (reads agent configuration directories, reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vision-skills
Local vision CLIs: glance (describe/ask/OCR an image), ground (locate a target, pixel box), detect (element inventory), trace (image to SVG geometry), crop (cut a pixel box to a file), and scripts/htmlshot.py (HTML file to image). Use for any task involving an image — questions, text, splitting and transcribing long…
subagent-driven-development
Execute plan by dispatching fresh subagent per task, with two-stage review after each: spec compliance review first, then code quality review.
openspec
A specification-driven development process that records proposed software changes, implementation tasks, and updates to the project’s current behavior specifications.
frontend-design
A design and coding guide for building distinctive web interfaces, including pages, dashboards, landing pages, and reusable components.
verification-before-completion
A completion-checking skill that requires fresh command output or other direct evidence before claiming a coding task is finished.
brainstorming
A structured conversation process for turning a vague creative or software request into an agreed design before implementation. It requires context discovery, one question at a time, alternative approaches, and written approval.