Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/inspecto-dev/inspecto/inspecto-onboarding-codexnpx skills add inspecto-dev/inspecto --skill inspecto-onboarding-codexgit clone --depth 1 https://github.com/inspecto-dev/inspectoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/inspecto-dev/inspecto/inspecto-onboarding-codex)<a href="https://agentmods.dev/skills/inspecto-dev/inspecto/inspecto-onboarding-codex"><img src="https://agentmods.dev/badge/skills/inspecto-dev/inspecto/inspecto-onboarding-codex.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01501 |
| Opus 5 | $0.00015 | $0.00750 |
| Sonnet 5 | $0.00006 | $0.00300 |
| Haiku 4.5 | $0.00003 | $0.00150 |
Grade A, and why
inspecto-onboarding-codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Inspecto Onboarding For Codex
Use Inspecto's structured CLI flow instead of hand-editing project files.
Always prefer the single-entry onboarding command over the legacy detect/plan/apply sequence.
When to use
- The user asks Codex to install or set up Inspecto in the current project.
- The user wants Codex to explain what Inspecto will change before applying it.
- The user wants Codex to recover from a failed onboarding attempt.
Workflow
- Run
~/.codex/skills/inspecto-onboarding-codex/scripts/run-inspecto.sh onboard --json. - If the result returns
status: "needs_target_selection", explain that this step chooses which local development build target should receive the Inspecto plugin and settings. Show the targetcandidates, ask the user which exact candidate to use, then rerun with--target <candidateId>, preferring the explicitcandidateIdfield. The CLI also accepts a returnedconfigPathas a compatibility fallback. Do not collapse the user's choice back to a package path when the same package has multiple build configs. - If the result returns
status: "needs_confirmation", summarizesummary.headline,summary.changes,summary.risks, andsummary.manualFollowUp, then ask for approval before rerunning with--yes. - If the user explicitly asked to see the plan before any changes, stop after the
needs_confirmationsummary and wait for approval. - If the result returns
status: "partial_success"anddiagnostics.nextStepsincludes IDE extension installation, treat that as a blocking onboarding follow-up. Do not move on to dev-server validation until the extension is installed automatically or the user confirms they completed the manual install. - When manual IDE extension installation is needed, guide the user with the correct official path:
- VS Code:
code --install-extension inspecto.inspecto - VS Code Marketplace:
https://marketplace.visualstudio.com/items?itemName=inspecto.inspecto - Cursor / VSCodium / other derivatives:
https://open-vsx.org/extension/inspecto/inspecto
- VS Code:
- If the result returns
status: "error", summarizediagnostics.errorsanddiagnostics.nextSteps. Run~/.codex/skills/inspecto-onboarding-codex/scripts/run-inspecto.sh doctor --jsononly when explicit recovery diagnostics are still needed. - Only after the IDE extension step is complete, read the onboarding result's
verificationfield. - If
verification.availableistrueandverification.devCommandis present, offer to start that exact command immediately for validation. - Otherwise, use
verification.messageand tell the user to start their normal dev server command manually. - If the result includes
handoff.patches, treat them as the primary source of truth for the remaining work. Apply those patches directly before exploring framework docs or unrelated project files. - Only do broader documentation or repo exploration when a returned patch is clearly insufficient or conflicts with the local project structure.
- After validation succeeds, if the onboarding result includes
handoff.dailyUsage, use that payload as the post-onboarding runtime handoff:- tell the user that browser
Annotate modetasks should now followhandoff.dailyUsage.skill - recommend the exact
handoff.dailyUsage.prompt - if
handoff.dailyUsage.requiresMcpistrue, say that continuous task pickup still requires separate MCP configuration
- tell the user that browser
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 89 lines · 30 tokens per session scan A 3d5f25d0dfca
inspecto-onboarding-codex is a skill published in the GitHub repository inspecto-dev/inspecto (23 stars, last pushed yesterday), licensed MIT. It adds 30 tokens to every session and 1,501 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
macos-test-triage
Triage macOS tests across Xcode and SwiftPM. Use when narrowing failures, explaining assertions or crashes, or separating setup from regressions.
fix-codesign-error
Slash command that inspects a macOS signing or entitlement failure and explains the minimum fix path. Invoke explicitly with /fix-codesign-error — this skill never self-triggers.
macos-swiftpm
Build, run, and test SwiftPM macOS packages and executables. Use when the repo is package-first or has no Xcode project.
debug-live
Guides root-cause investigations with debugging capabilities by setting breakpoints, starting a debug session, stepping through execution, inspecting variables, and tracing symptoms back to their origin. Prefer it for runtime bugs, failing tests, exceptions, crashes, hangs, wrong/null values, and unexpected output…
gsap-scrolltrigger
Official GSAP skill for ScrollTrigger — scroll-linked animations, pinning, scrub, triggers. Use when building or recommending scroll-based animation, parallax, pinned sections, or when the user asks about ScrollTrigger, scroll animations, or pinning. Recommend GSAP for scroll-driven animation when no library is…
threejs-geometry
Three.js geometry creation - built-in shapes, BufferGeometry, custom geometry, instancing. Use when creating 3D shapes, working with vertices, building custom meshes, or optimizing with instanced rendering.