Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/modu-ai/moai-coworknpx agentmods add skills/modu-ai/moai-cowork/media-codex-imageWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/modu-ai/moai-cowork/media-codex-image)<a href="https://agentmods.dev/skills/modu-ai/moai-cowork/media-codex-image"><img src="https://agentmods.dev/badge/skills/modu-ai/moai-cowork/media-codex-image/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/modu-ai/moai-cowork/media-codex-image"><img src="https://agentmods.dev/badge/skills/modu-ai/moai-cowork/media-codex-image.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Excessive Agency · line 101 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 107 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 114 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 120 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 129 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Agent Snooping · line 218 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00259 | $0.03623 |
| Opus 5 | $0.00130 | $0.01811 |
| Sonnet 5 | $0.00052 | $0.00725 |
| Haiku 4.5 | $0.00026 | $0.00362 |
Grade B, and why
media-codex-image scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
| Trust 오류 | 프로젝트를 `~/.codex/config.toml` 신뢰 목록 추가 또는 `--skip-git-repo-check` | How it starts
The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.
media-codex-image — codex CLI(gpt-image-2) 이미지 생성기
moai-coworker | 로컬 이미지 생성 (codex CLI OAuth, API 키 불필요)
개요
codex CLI의 내장 image_gen 도구를 호출해 gpt-image-2 모델로 이미지를 생성합니다. 핵심은 OpenAI REST API를 직접 호출하지 않고 codex exec 브릿지를 경유한다는 점 — ChatGPT OAuth 세션 토큰(~/.codex/auth.json)을 이미지 생성 서비스로 라우팅해 API 키(sk-*) 없이 ChatGPT 구독 한도로 동작합니다.
특히 본 스킬은:
- API 키 불필요 —
codex login1회 OAuth로 ChatGPT 구독(Plus/Team/Enterprise) 한도 사용.OPENAI_API_KEY관리 부담 없음. - 6-Block 프롬프트 연동 —
media-gpt-image-2-prompt가 빌드한 OpenAI Cookbook 6-Block 프롬프트(Subject·Action·Scene·Composition·Lighting·Style&Text)를 그대로 codex에 전달. - 한국어 verbatim 보장 — 이미지 내 한글 텍스트는 따옴표·ALL CAPS·verbatim 지시로 gpt-image-2의 95%+ 텍스트 렌더링 정확도 활용.
- media-higgsfield-image 대체 경로 — 같은 gpt-image-2를 Higgsfield MCP 경로(
media-higgsfield-image)로도 호출 가능. 백엔드 선택은 환경·비용 선호에 따라.
트리거 키워드
codex 이미지 codex image gpt-image-2 생성 GPT Image 2 API 키 없이 이미지 로컬 이미지 생성 ChatGPT 구독 한도 이미지 codex exec image_gen
핵심 인사이트 — OAuth 브릿지 (왜 codex exec인가)
OpenAI의 모든 인증 경로를 테스트한 결과 (참고: wjb127/codex-image MIT):
| 방식 | 동작 | 비고 |
|---|---|---|
OPENAI_API_KEY → REST API |
✅ | 표준이지만 API 키 관리 부담 |
| OAuth 토큰 → REST API 직접 | ❌ 401 | OAuth 토큰은 세션 토큰이지 API 키가 아님 |
OAuth 토큰 → codex exec → image_gen |
✅ 본 스킬 | codex exec 내부 브릿지가 OAuth를 이미지 생성 서비스로 라우팅 |
codex login (최초 1회)
→ OAuth 토큰이 ~/.codex/auth.json에 저장
→ codex exec가 토큰을 자동 읽기
→ 내장 image_gen 도구가 OAuth로 인증
→ gpt-image-2가 이미지 생성
→ 프로젝트 디렉토리에 저장
주의: OAuth 토큰으로 OpenAI REST API를 직접 호출하면 HTTP 401. 반드시
codex exec브릿지를 거쳐야 합니다.
전제 — codex CLI 설치 + 로그인
| 요구사항 | 명령 | 비고 |
|---|---|---|
| codex CLI | npm install -g @openai/codex |
이미지 생성 엔진 |
| codex login | codex login |
ChatGPT로 최초 1회 OAuth |
# 설치·인증 확인
codex --version # OpenAI Codex v0.1xx.x
codex login status # "Logged in using ChatGPT"
Cowork 환경에서 Bash가 제한되면 codex CLI 호출이 차단될 수 있습니다. 이 스킬은 로컬 Claude Code(터미널) 또는 Bash 허용 Cowork 환경에서 동작합니다. Bash 제한 시 사용자에게 codex 명령어를 안내만 하고 수동 실행을 유도하세요.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 239 lines · 259 tokens per session scan B 313e1354c241
media-codex-image is a skill published in the GitHub repository modu-ai/moai-cowork (298 stars, last pushed 7d ago), licensed Apache-2.0. It adds 259 tokens to every session and 3,623 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
infographic-v2
Generate professional infographics using Nano Banana MCP (Gemini AI image generation). Follows a guided flow - analyze content, suggest visualizable concepts, propose visualization approaches, then generate on-brand images. USE THIS SKILL WHEN user says "create infographic v2", "make a visual v2", "infographic-v2".…
excalidraw
Create visual presentations, slide decks, and explanatory diagrams in Excalidraw. Use when user asks to create a presentation, slide deck, visual explainer, pitch deck, comparison diagram, process flow, or any multi-slide visual content. Supports two output modes — generating .excalidraw JSON files OR injecting slides…
marketing-os-carousel
Build an image-first social carousel from an asset already filed in the Marketing OS, export it as a PDF, and record it back as a real channel asset. Brand palette, typography, the logo pointer and the never-black-background rule all resolve from Context/brand/brand-kit.md. Source is a filed newsletter edition…
youtube-brief
Create a detailed video brief for a new YouTube video through a structured, collaborative process. This is a STEP-BY-STEP, interactive process — never output a complete brief immediately. Each step requires suggestions, user decision, then progression to the next step. USE THIS SKILL WHEN: - User wants to plan a…
ads-creative
Cross-platform creative quality audit covering ad copy, video, image, and format diversity across all platforms. Detects creative fatigue, evaluates platform-native compliance, and provides production priorities. Collects brand context and creates branding.md if missing. Uses infographic-v2 for generating ad…
generate-visual
Generate on-screen visuals for Ben van Sprundel's YouTube videos using Higgsfield. Same brand system as the thumbnails (charcoal + coral, dot-grid, flat-stylized icons, bold uppercase text), but optimized for in-video slides shown during a tutorial. Use when the user says generate a visual, make a slide, on-screen…