Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/k9i-0/ccpocket/codex-guidenpx skills add K9i-0/ccpocket --skill codex-guidegit clone --depth 1 https://github.com/K9i-0/ccpocketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/k9i-0/ccpocket/codex-guide)<a href="https://agentmods.dev/skills/k9i-0/ccpocket/codex-guide"><img src="https://agentmods.dev/badge/skills/k9i-0/ccpocket/codex-guide.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.00943 |
| Opus 5 | $0.00042 | $0.00472 |
| Sonnet 5 | $0.00017 | $0.00189 |
| Haiku 4.5 | $0.00008 | $0.00094 |
Grade A, and why
codex-guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Codex Guide
Codex の使い方や仕様を案内するときのガイド。
この skill を使う場面
- ユーザーが Codex CLI / app / IDE extension の使い方を聞いたとき
rules,execpolicy, approvals, hooks,AGENTS.md, skills, subagents, MCP, config を説明するとき- Codex のモデル、設定、コマンド、slash command、運用方法を案内するとき
- Codex について「本当にそういう仕様か」を確認したいとき
基本方針
- 記憶で断定しない。 まず OpenAI の公式 Codex docs を確認する。
- 仕様説明は一次情報優先。 非公式ブログや推測をベースにしない。
- rules / approvals は docs だけで終わらせない。
codex execpolicy checkで実際の判定を確認する。 - コマンド挙動は再現確認する。 可能なら軽い実コマンドで
allow/prompt/forbiddenを確かめる。 - 変わりやすい情報は公式 docs hub から辿る。 直リンクが変わっていそうなら Codex docs トップから探し直す。
標準ワークフロー
1. まず公式 docs を探す
用途ごとに references/official-sources.md の該当ページを開く。
- Codex 全体像: docs hub / CLI / Academy
- 設定: Config basics / advanced / reference / sample
- approvals / rules: Rules
- カスタマイズ: Skills / Subagents / AGENTS.md / Hooks / MCP
- 実践例: Academy / Use cases /
openai/codex
2. rules / execpolicy の相談なら必ず検証する
変更提案前に、少なくとも以下を実行する。
codex execpolicy check --pretty --rules <rules-file> -- <command...>
最低 2 パターン確認すること。
- 許可したいコマンド
- 止めたい、または prompt にしたいコマンド
部分許可を設計するときは、重なる rule も確認する。
3. 実運用に近いコマンドで再確認する
execpolicy check だけでなく、可能なら軽い実コマンドでも確認する。
例:
allow想定の軽いコマンドを 1 本prompt想定の軽いコマンドを 1 本
特に注意すること
prefix_ruleは複数一致する。最終判定は より厳しい decision が勝つ。- 部分
allowを書いても、より広いpromptが同時一致すると最終的にpromptになる。 - 迷ったら「広く
allow、危ないサブコマンドだけprompt」か、「全部明示列挙」のどちらかで設計する。 match/not_matchを書ける場面では書く。意図ミスの早期発見に使う。
返答のしかた
- 公式 docs を見てわかったことと、ローカルで検証したことを分けて書く。
- 推測が混じる場合は、それが推測だと明示する。
- ルール提案時は、提案内容だけでなく「なぜその rule が最終判定になるか」も書く。
参照先
詳細な URL と用途は references/official-sources.md を見る。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 77 lines · 83 tokens per session scan A fe771d589dc4
codex-guide is a skill published in the GitHub repository K9i-0/ccpocket (1,047 stars, last pushed 4d ago), licensed MIT. It adds 83 tokens to every session and 943 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
zmr-mobile-testing
Use when testing mobile apps with Zeno Mobile Runner, integrating app-local .zmr setup, driving Android or iOS simulator scenarios, using JSON-RPC or MCP agent sessions, exporting traces, or comparing mobile runner benchmarks.
cloudx-integrate
Integrate the CloudX SDK into a publisher app on any supported platform (Android, iOS, React Native, Flutter, Unity). Use when asked to integrate, add, install, or set up CloudX, CloudX ads, or CloudX mediation in an app, including alongside or replacing an existing mediation stack such as AppLovin MAX, LevelPlay, or…
cloudx-audit
Audit an existing CloudX SDK integration in a publisher app for correctness, staleness, lifecycle, coexistence, and privacy issues. Use when asked to check, audit, review, or validate a CloudX integration that already exists, or after upgrading the CloudX SDK version.
mobile
Mobile development with React Native, Flutter, and native patterns.
android-e2e-readiness
Use when Android mobile E2E flows are flaky, Compose and View screens disagree with automation, hybrid screens are ambiguous, retries hide the real issue, or the team keeps collapsing the problem to selector-vs-timing without checking Android-specific readiness contracts.
ios-e2e-readiness
Use when iOS mobile E2E flows are flaky, SwiftUI and UIKit surfaces disagree with automation, mixed screens are ambiguous, retries hide the real issue, or the team keeps collapsing the problem to timing-only or SwiftUI-only without checking iOS-specific readiness contracts.