Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/heapy/kortex/install-codex-agentsnpx skills add Heapy/kortex --skill install-codex-agentsgit clone --depth 1 https://github.com/Heapy/kortexWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.00963 |
| Opus 5 | $0.00013 | $0.00481 |
| Sonnet 5 | $0.00005 | $0.00193 |
| Haiku 4.5 | $0.00003 | $0.00096 |
Grade A, and why
install-codex-agents scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Install Codex Agents
Codex cannot load agents from a plugin. Its plugin.json has no agents field, so a plugin that
ships agents has to copy them into a Codex agents directory. This skill does that copy.
This skill is for Codex only. In Claude Code and Junie the same agents ship with the plugin/extension and are already available — say so and stop.
What gets installed
The assets/ directory next to this SKILL.md holds one .toml file per agent:
| File | Agent |
|---|---|
kotlin-test-review.toml |
judges whether Kotlin tests prove the code works |
kotlin-architecture-review.toml |
judges module split, dependencies, SOLID, and core purity |
kotlin-abi-review.toml |
judges whether a library release breaks binary compatibility |
Read the directory rather than trusting this table; the plugin may ship more.
Ask where
Offer two targets. The default is global.
| Target | Path | Effect |
|---|---|---|
| global (default) | ~/.codex/agents/ |
available in every project on this machine |
| project | <repo root>/.codex/agents/ |
available in this repository only, and can be committed |
Ask once, in one line, and take the default if the user does not care.
A global install writes outside the workspace, so Codex asks once to raise the sandbox. That prompt is expected; tell the user before it appears. A project install stays inside the workspace and needs no prompt.
Install
- Confirm the target directory, then create it:
mkdir -p <target>. - Before writing anything, parse the
namefrom every shipped asset and every existing<target>/*.toml. Build aname -> [paths]map and compare each canonical target file with its asset. - Finish the whole preflight before copying any file. Collect and show:
- an incoming
namealready present under another file name; - a canonical target file whose content differs from the asset;
- an existing TOML that cannot be parsed well enough to rule out a conflict.
- an incoming
- If preflight found a conflict, make no changes yet. Show every involved path and the diff of each
existing file against the incoming asset when comparable. Ask for an explicit action for every
path that would be overwritten, renamed, or deleted. A choice of which identity should remain is
not by itself permission to delete a locally customized file. Never create two files with the same
agent
name. - After conflicts are resolved, handle every canonical asset file:
- Missing and with no name collision: copy it.
- Present and identical: skip it and say so.
- Present and different: overwrite only when that exact path was approved.
- Copy with
cp <assets>/<file> <target>/<file>. Do not rewrite the contents on the way through. - List what was written, skipped, explicitly overwritten or removed, and left unresolved.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 87 lines · 26 tokens per session scan A 3f60023d01e6
install-codex-agents is a skill published in the GitHub repository Heapy/kortex (5 stars, last pushed 4d ago), licensed Apache-2.0. It adds 26 tokens to every session and 963 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
skills-manager-cli
Drive the Skills Manager CLI (skm) to initialize the hub, adopt unmanaged skills, list/enable/disable skills per AI tool, and doctor/fix symlink sync. Use whenever the user or an agent needs to manage skills from a terminal, SSH session, CI job, or headless machine; when a skill is missing in Claude Code, Codex…
ppt-design-skill
Design, generate, review, and revise editable PowerPoint presentations through a rigorous brief-to-PNG workflow using the public pptx-designer Python library.
cesiumjs-camera
CesiumJS camera control - Camera, flyTo, lookAt, setView, ScreenSpaceCameraController, CameraEventAggregator, flight animation. Use when positioning the camera, creating flyTo animations, constraining user navigation, tracking entities, or converting between screen and world coordinates.
cesiumjs-custom-shader
CustomShader authoring — vertexShaderText and fragmentShaderText against VertexInput, FragmentInput, FeatureIds, Metadata, czmmodelMaterial. Use when reading EXTmeshfeatures or EXTstructuralmetadata property textures/tables, vertex displacement, or shading VoxelPrimitive.
cesiumjs-primitives
CesiumJS primitives and geometry - Primitive, GeometryInstance, Appearance, BufferPrimitive collections, GeoJsonPrimitive, Billboard/Label/PointPrimitive collections, built-in geometry shapes, ground primitives, classification. Use when rendering performance-critical static or vector geometry, loading GeoJSON without…
cesiumjs-time-properties
CesiumJS time, properties, and animation - Clock, JulianDate, TimeInterval, Property, SampledProperty, CallbackProperty, PathMode, interval and sampled path materials, interpolation, splines, CZML temporal data. Use when making entity attributes or path materials time-dynamic, configuring the simulation clock…