Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jiayx01/codex-claude-skills --skill codex-orchestratorgit clone --depth 1 https://github.com/jiayx01/codex-claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jiayx01/codex-claude-skills/codex-orchestrator)<a href="https://agentmods.dev/skills/jiayx01/codex-claude-skills/codex-orchestrator"><img src="https://agentmods.dev/badge/skills/jiayx01/codex-claude-skills/codex-orchestrator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jiayx01/codex-claude-skills/codex-orchestrator"><img src="https://agentmods.dev/badge/skills/jiayx01/codex-claude-skills/codex-orchestrator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01002 |
| Opus 5 | $0.00024 | $0.00501 |
| Sonnet 5 | $0.00010 | $0.00200 |
| Haiku 4.5 | $0.00005 | $0.00100 |
Grade B, and why
codex-orchestrator scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
The companion hardcodes `sandbox: write ? "workspace-write" : "read-only"`, which **overrides** `danger-full-access` in `~/.codex/config.toml`. So the writable root is whatever cwd you passed in — **not** the path writte How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Orchestrator: Claude plans, Codex executes
You plan, break down the work, and review; execution defaults to delegation to Codex. How to write the task brief, and when to use --write/--background/--resume, is already covered by the official plugin's built-in codex:codex-cli-runtime and codex:gpt-5-4-prompting — don't re-litigate that. What follows is only what those two Skills don't cover.
Whether to use Codex at all is the user's call — don't run a cost-benefit check on their behalf, and don't talk them out of it.
Invocation path
- Target project == session cwd:
Agenttool,subagent_type: "codex:codex-rescue" - Target is outside cwd: call the companion script directly via Bash, with
--cwd(--cwdisn't on rescue's flag allowlist — going through the Agent path would leak it into the prompt text instead)
COMPANION=$(ls ~/.claude/plugins/cache/openai-codex/codex/*/scripts/codex-companion.mjs 2>/dev/null | sort -V | tail -1)
node "$COMPANION" task "<task brief>" --write --model <your model> --effort <your tier> --cwd <target project root>
Swap --model/--effort for whatever your own account or gateway actually supports.
Never use Skill(codex:rescue) — it re-enters the slash command and hangs the session. /codex:rescue is the user-typed entry point only.
Effort tier: the companion's --effort allowlist currently tops out at xhigh — passing ultra throws immediately. To actually get ultra, omit the flag and let it fall through to the config default.
Sandbox: the writable root is cwd
The companion hardcodes sandbox: write ? "workspace-write" : "read-only", which overrides danger-full-access in ~/.codex/config.toml. So the writable root is whatever cwd you passed in — not the path written in the task brief. When the target is outside cwd, the write either fails outright, or lands in the wrong place while Codex still self-reports success (this has happened in practice).
Checking results in the background
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 54 lines · 49 tokens per session scan B 1015b3b645ae
codex-orchestrator is a skill published in the GitHub repository jiayx01/codex-claude-skills (4 stars, last pushed 28d ago), licensed MIT. It adds 49 tokens to every session and 1,002 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
deploy-from-stale-worktree-silent-rollback
Diagnose "I deployed a new Cloud Run / Docker image but a bunch of recently merged fixes regressed in production." Use when: (1) the deploy script does gcloud builds submit ... "${SCRIPTDIR}" or docker build (build context = local filesystem, NOT a git ref), (2) the user has many git worktrees / multiple checkouts of…
merged-pr-not-deployed-gate-label-missing
Diagnose "I merged my PR + CI is green but the live service still doesn't show my changes." Use when: (1) a code-bearing PR has been squash-merged into main with all required status checks passing, (2) the user reports the change is still missing from the deployed environment minutes-to-hours later, (3) the repo has a…
pr-from-stale-branch-silently-reverts-newer-main-files
Trap: merging a PR whose branch carries an OLD TREE silently DELETES (reverts) files that landed on main after that tree was built — with NO merge conflict to warn you, because a deletion your own commit records is not a conflict. Use when: (1) about to gh pr create or squash-merge from a long-lived / earlier-branched…
prep-pr-close-keyword-auto-closes-issue
Diagnose and prevent the trap where a scaffolding/prep/planning/handoff PR (one that ships a paste-ready prompt, an ADR, an implementation plan, or any docs-only artefact describing FUTURE work) contains a close-keyword like closes #N / fixes #N / resolves #N in its TITLE or BODY, which GitHub auto-applies at merge…
stale-base-pr-silently-reverts-upstream-content
Detect and recover when a sibling PR's squash-merge silently reverts an upstream PR's content changes because the sibling was based on a pre-upstream main snapshot and its line-level rewrites overlapped the upstream PR's edits. Use when: (1) two PRs are open in parallel against the same file(s) — one refreshing…
credit-stall-mid-orchestration-revive-collision
Recover gracefully when an Anthropic credit/billing failure stalls multiple in-flight parallel subagents mid-orchestration, then later resolves. Use when: (1) you've dispatched 2+ parallel subagents (Task tool with runinbackground: true) and a credit/billing issue, MCP outage, or other transient harness failure has…