Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/keyargo/custodian-codex-guard/govern-codexnpx skills add KeyArgo/custodian-codex-guard --skill govern-codexgit clone --depth 1 https://github.com/KeyArgo/custodian-codex-guardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/keyargo/custodian-codex-guard/govern-codex)<a href="https://agentmods.dev/skills/keyargo/custodian-codex-guard/govern-codex"><img src="https://agentmods.dev/badge/skills/keyargo/custodian-codex-guard/govern-codex.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00593 |
| Opus 5 | $0.00018 | $0.00296 |
| Sonnet 5 | $0.00007 | $0.00119 |
| Haiku 4.5 | $0.00004 | $0.00059 |
Grade A, and why
govern-codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Govern Codex
Enforcement is mandatory and automatic: Custodian installs a Codex PreToolUse
hook (custodian-codex setup) that the harness runs before every tool call
and that can block it outright. This holds even under approval_policy = "never"
or a trusted project, and does not depend on you calling any tool. A blocked call
returns permissionDecision: "deny" with the reason; a consequential action you
have not had approved is blocked with a custodian-codex approve ID --digest DIGEST instruction — ask the operator to run it, then retry the identical
action once. You cannot split a forbidden operation into smaller calls to evade
the hook; each call is evaluated independently.
The guard_action MCP tool below remains available for previewing a decision or
for surfacing receipts, but it is no longer what enforces policy. Use it to
classify a proposal using exactly one action kind:
read: local read-only inspectiontest: local test or build with no external side effectwrite: ordinary workspace editnetwork: any outbound network request or remote readcredential: resolving, injecting, or using a credentialdestructive: deletion, overwrite, history rewrite, or irreversible actionproduction: deployment or production-state changemoney: payment, refund, purchase, or financial commitmentgovernance: changing policy, audit, approval, vault, or the guard itself
Pass the actual tool name and structured arguments, plus a stable requester ID
for this Codex session. Never put a raw secret in
the call; use a paladin:// reference. Treat the verdict mechanically:
autonomous: proceed with the exact evaluated action.escalation_required: stop, show the returned approval ID, and ask the human to run the exactcustodian-codex approve ID --digest DIGESTcommand returned by Guard. Callguard_actionagain with that same ID and the exact same action. The verdict itself is not approval.approved: proceed once with the exact evaluated action. Any argument change requires a new request; never reuse an approval ID.denied: do not execute. Explain the denial without exposing sensitive data.
If Guard is unavailable, malformed, or returns an unknown verdict, fail closed
for writes and consequential actions. Do not split one forbidden operation into
smaller calls to evade policy. After a demo, call verify_receipts to prove the
local decision chain has not been edited.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 49 lines · 36 tokens per session scan A 00954a5232ec
govern-codex is a skill published in the GitHub repository KeyArgo/custodian-codex-guard (2 stars, last pushed 14d ago), licensed Apache-2.0. It adds 36 tokens to every session and 593 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
openbot-data-access
Governs how the OpenBot browser app reads and writes server data — every request goes through client in app/src/lib/client.ts, every read is a queryOptions factory in app/src/lib/ /queries.ts, every write is a mutationOptions factory in app/src/lib/ /mutations.ts, and components consume them through…
openbot-screen-layout
The default layout for every OpenBot configuration screen — PageShell and its prose/wide widths, PageSection and PageRows, Item row composition, the settings-row pattern where a summary and a chevron open a dialog, and the size and variant vocabulary. This is what a new screen looks like unless an instruction says…
warp-delegate
Delegate a coding task to the Warp Agent CLI (oz) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Warp - phrasings like "have Warp implement X", "delegate this to the Warp CLI", "run it through Warp", "use oz to…
claude-delegate
Delegate a coding task to a separate Claude Code CLI process or another Claude session as an implementer, then review its diff and land it yourself. Use only when the user explicitly asks to delegate implementation to Claude Code, another Claude session, or the claude CLI — for example, "have another Claude implement…
zcode-delegate
Delegate a coding task to the Z.AI ZCode CLI as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to ZCode — phrasings like "have ZCode do X", "delegate this to ZCode", "run it through ZCode", or "use ZCode to implement/fix/refactor" — or…
cline-delegate
Delegate a coding task to the Cline coding agent CLI (cline) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Cline - phrasings like "have Cline implement X", "delegate this to cline", "run it through Cline", or "use cline to…