Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add LeeJuOh/claude-code-zero/plugin install codex-advisorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/leejuoh/claude-code-zero/codex-review)<a href="https://agentmods.dev/skills/leejuoh/claude-code-zero/codex-review"><img src="https://agentmods.dev/badge/skills/leejuoh/claude-code-zero/codex-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/leejuoh/claude-code-zero/codex-review"><img src="https://agentmods.dev/badge/skills/leejuoh/claude-code-zero/codex-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.03307 |
| Opus 5.5 | $0.00021 | $0.01323 |
| Sonnet 5.5 | $0.00011 | $0.00661 |
| Haiku 4.5 | $0.00005 | $0.00331 |
Grade B, and why
codex-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`--model` and `--effort` go through `scripts/apply-codex-config.py`, which updates `~/.codex/config.toml` before the companion launches — see the Apply block below. Never put `--effort` on the review command: review has How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Code Review + Double-Check
You are a translator + executor. The user can type anything — flags, Korean, English, meta-instructions, emoji. Your first job is to figure out intent and produce a clean invocation of the Official Codex plugin's companion. Your second job is to hand what Codex returns to a fresh Verifier subagent and report what it decides. The judging is deliberately not yours.
Execution Contract
This contract overrides default exploration habits. Read it before Phase 1.
| Phase | Allowed | Forbidden |
|---|---|---|
| 1 ANALYZE | codex-task.sh check-ref, apply-codex-config.py |
cat, head, tail, git diff, git log -p, git show, git blame, Read, Grep, Glob |
| 2 INVOKE | codex-task.sh review (multi-arg form only — never $ARGUMENTS blob) |
All source reads |
| 3 WAIT | codex-task.sh review-wait loop (≤8 calls, about 30 min), then Read OUT_FILE |
All source reads, run_in_background, ps/kill |
| 4 VERIFY | codex-task.sh payload, then Agent (codex-advisor:verifier) per group |
Reading source; judging or re-judging any finding yourself |
| 5 REPORT + SAVE | codex-report.sh save, codex-report.sh clean |
Write tool for the report |
The companion collects the diff and context itself. Your value-add is a
verdict reached by someone with no stake in the code, not pre-analysis.
The companion's parser turns an unknown flag into
focus text (parseArgs in lib/args.mjs), and the built-in review rejects
focus text, so the run fails. Phase 1 whitelist catches it first.
Phase 1: Analyze
You are a translator. Use LM intelligence, not regex tables.
Whitelist for this skill: --base <ref>, --scope <auto|working-tree|branch>, --model <slug>, --effort <level>. Nothing else.
--model and --effort go through scripts/apply-codex-config.py, which updates ~/.codex/config.toml before the companion launches — see the Apply block below. Never put --effort on the review command: review has no such flag, so the companion would mix it into the prompt. Why, and when --model does go on the command: references/companion-usage.md §2.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · -33 lines 689d7c3fc023
- 22d ago Changed · +2 lines d85d5e4e30f5
- 26d ago Changed · +65 lines 3d04f120c90a
- 1mo ago First seen · 216 lines · 53 tokens per session scan B 199faff5f4a2
codex-review is a skill published in the GitHub repository LeeJuOh/claude-code-zero (52 stars, last pushed 3d ago), licensed MIT. It adds 53 tokens to every session and 3,307 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cpp-coding-standards
C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.
simplify-code
Parallel 4-agent cleanup of recent code changes.
coding-standards
Baseline cross-project coding conventions for naming, readability, immutability, and code-quality review. Use detailed frontend or backend skills for framework-specific patterns. Use when reviewing code quality or naming with no framework-specific skill that applies.
pr-lens
Draw code changes as animated architecture/data-flow SVGs.
opencode
Delegate coding to OpenCode CLI (features, PR review).
requesting-code-review
Pre-commit review: security scan, quality gates, auto-fix.