Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jl-cmd/claude-dev-env/codex-reviewnpx skills add jl-cmd/claude-dev-env --skill codex-reviewgit clone --depth 1 https://github.com/jl-cmd/claude-dev-envWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jl-cmd/claude-dev-env/codex-review)<a href="https://agentmods.dev/skills/jl-cmd/claude-dev-env/codex-review"><img src="https://agentmods.dev/badge/skills/jl-cmd/claude-dev-env/codex-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.02856 |
| Opus 5 | $0.00032 | $0.01428 |
| Sonnet 5 | $0.00013 | $0.00571 |
| Haiku 4.5 | $0.00006 | $0.00286 |
Grade A, and why
codex-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Review
Runs one Codex review pass against a chosen target, classifies the outcome, and hands findings to the shared fix protocol. Does not reimplement opt-out parsing or the fix sequence.
When this skill applies
- The user wants Codex (the OpenAI Codex CLI) as a reviewer on the current PR branch, or on uncommitted work when no PR loop is active.
- The user asks to babysit or re-run Codex review after fixes.
Refusals
Respond with the quoted line exactly and stop:
- Opt-out gate exit 0:
/codex-review is disabled via CLAUDE_REVIEWS_DISABLED. - Version or shape probe reports Codex unavailable:
/codex-review cannot run: Codex CLI is missing or the shape probe failed. - Skill class is
down(wrapperoutcome_classiscodex_down):/codex-review cannot complete: Codex reviewer is down.
Gate exits other than 0 or 1 are blockers: stop without a probe or review invoke. Do not invent an opt-out refusal for a non-opt-out failure.
Sub-skills
| Skill | When | Produces |
|---|---|---|
reviewer-gates |
Step 0 — opt-out semantics for external reviewers | Gate contract for reviews_disabled.py; refusal line shape |
pr-fix-protocol |
Step 5 — classification is findings |
Fix sequence, reply-and-resolve unit, unresolved-thread sweep |
If pr-fix-protocol is not installed when findings exist, stop with: /codex-review needs the pr-fix-protocol skill to apply findings.
Process checklist
- [ ] Step 0 — Opt-out gate
- [ ] Step 1 — Version and shape probe
- [ ] Step 2 — Target pick
- [ ] Step 3 — Run classifying review
- [ ] Step 4 — Classify outcome
- [ ] Step 5 — Route findings (or stop on clean / down)
Step 0: Opt-out gate
Before any other work, run:
python "$HOME/.claude/_shared/pr-loop/scripts/reviews_disabled.py" --reviewer codex
- Exit 0 — Codex reviews are disabled: refuse with the opt-out line above. Do not probe, review, or fix.
- Exit 1 — continue.
- Any other exit — treat as a blocker and stop; do not skip the gate or continue as if it exited 1. Do not report the opt-out refusal line for a non-opt-out failure.
What ships with it
30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .claude/CLAUDE.md 14 B
- AGENTS.md 1 B
- reference/.claude/CLAUDE.md 14 B
- reference/AGENTS.md 1 B
- reference/cli-contract.md 14 KB
- reference/loop-integration.md 6.9 KB
- scripts/codex_down_classifier.py 3.2 KB runs code
- scripts/codex_review_scripts_constants/__init__.py 58 B runs code
- scripts/codex_review_scripts_constants/.claude/CLAUDE.md 14 B
- scripts/codex_review_scripts_constants/AGENTS.md 1 B
- scripts/codex_review_scripts_constants/classifier_constants.py 848 B runs code
- scripts/codex_review_scripts_constants/codex_usage_probe_constants.py 2.4 KB runs code
- scripts/codex_review_scripts_constants/findings_constants.py 530 B runs code
- scripts/codex_review_scripts_constants/run_constants.py 1.7 KB runs code
- scripts/codex_usage_probe.py 19 KB runs code
- scripts/fixtures/auth_failure_synthetic.txt 71 B
- scripts/fixtures/config_load_failure_v0.125.0.txt 98 B
- scripts/fixtures/freeform_findings_v0.144.3.txt 420 B
- scripts/fixtures/model_rejection_v0.125.0.jsonl 573 B
- scripts/fixtures/structured_findings.txt 250 B
- scripts/fixtures/success_stream_v0.144.3.jsonl 585 B
- scripts/fixtures/unknown_failure_synthetic.txt 57 B
- scripts/fixtures/usage_limit_synthetic.txt 95 B
- scripts/parse_codex_findings.py 6.6 KB runs code
- scripts/run_codex_review.py 21 KB runs code
- scripts/test_codex_down_classifier.py 4.5 KB runs code
- scripts/test_codex_usage_probe.py 23 KB runs code
- scripts/test_parse_codex_findings.py 3.9 KB runs code
- scripts/test_run_codex_review.py 31 KB runs code
- test_skill_scaffold.py 7.1 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 182 lines · 64 tokens per session scan A f9bc834f208d
codex-review is a skill published in the GitHub repository jl-cmd/claude-dev-env (5 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 2,856 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…