Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jscraik/Agent-Skills --skill codex-hooks-buildergit clone --depth 1 https://github.com/jscraik/Agent-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jscraik/agent-skills/codex-hooks-builder)<a href="https://agentmods.dev/skills/jscraik/agent-skills/codex-hooks-builder"><img src="https://agentmods.dev/badge/skills/jscraik/agent-skills/codex-hooks-builder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jscraik/agent-skills/codex-hooks-builder"><img src="https://agentmods.dev/badge/skills/jscraik/agent-skills/codex-hooks-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.01649 |
| Opus 5 | $0.00044 | $0.00825 |
| Sonnet 5 | $0.00018 | $0.00330 |
| Haiku 4.5 | $0.00009 | $0.00165 |
Grade A, and why
codex-hooks-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Hooks Builder
Philosophy
Keep the workflow focused on the requested hook decision. Prefer repo-local contracts, wrappers, and validation before generic advice.
When To Use
- The user wants Codex hooks created, upgraded, installed, or audited.
- Repo-local or user-level .codex hook runtime files need hardening.
- A hook pack needs scaffold scripts or validation fixtures.
- The user wants runtime cards, subagent lifecycle hooks, artifact verification, hook decision telemetry, or claim-vs-evidence Stop checks.
Inputs
Require the target hook pack path, install boundary (repo-local, user-level, or plugin-owned), trigger events, script runtime, validation commands, schema/runtime evidence source, active hook sources, and rollback owner before writing.
Outputs
For non-trivial hook work, return schema_version: 1, target hook pack,
install boundary, changed paths, runtime contract, validation evidence,
rollback, blocker or residual risk, and confidence. The runtime contract must
name the runtime-card source, task-envelope injection, SubagentStop
reviewer-receipt validation, JSONL telemetry sink, and Stop
claim-versus-evidence checks when those lifecycle hooks are selected.
Discovery Interview
- Ask one round at a time.
- Use a plain-language question.
- Explain why this matters for the current skill decision.
- avoid dumping the whole interview plan at once.
- Read
references/discovery-interview.mdwhen the request is underspecified.
Workflow
- Start with 2-3 focused surfaces:
- Find hook config:
rg -n "SessionStart|SubagentStart|SubagentStop|PreToolUse|PermissionRequest|PostToolUse|PreCompact|PostCompact|UserPromptSubmit|Stop|hooks" .codex codex hooks . 2>/dev/null - Find executable scripts:
find . -path '*hook*' -type f -maxdepth 5 - Check source ownership before projection:
rg -n "allow_managed_hooks_only|hooks.json|codex_hooks" .
- Find hook config:
- Confirm repo-local versus user-level ownership before editing.
- Inspect hook config, scripts, install path, active sources, and trust state.
- Check current schema/runtime evidence before changing events, matchers, flags, or output handling.
- Model supported events: SessionStart, SubagentStart, SubagentStop, PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, UserPromptSubmit, Stop.
- Make the smallest source edit; use scaffold helpers only when they fit.
- For lifecycle or closeout hooks, define the runtime card path, task-envelope source, artifact receipt schema, blocked-state taxonomy, and telemetry sink before implementation.
- Validate config, script permissions, effective hook listing, and scaffold tests; fix the first failed gate before continuing.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 127 lines · 89 tokens per session scan A 441a8fb0fcbe
codex-hooks-builder is a skill published in the GitHub repository jscraik/Agent-Skills (8 stars, last pushed 10d ago), licensed Apache-2.0. It adds 89 tokens to every session and 1,649 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ad-creative
Plan and produce advertising concepts, copy variants, visual directions, and test matrices for paid campaigns.
humanizer-zh
Revise Chinese text to sound specific, fluent, restrained, and human while preserving facts and author intent.
skill-creator
Design and write concise reusable KunAgent skills with valid triggers, real tools, and testable completion criteria.
daily-brief
Produce a dated, source-linked daily brief with prioritized developments, implications, and watch items.
imf-data
Retrieve and analyze IMF macroeconomic series, forecasts, and reserve-composition data.
scholar-research
Search, screen, synthesize, and cite scholarly literature and author metadata.