Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pproenca/dot-skills --skill openai-codex-rust-patternsgit clone --depth 1 https://github.com/pproenca/dot-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pproenca/dot-skills/openai-codex-rust-patterns)<a href="https://agentmods.dev/skills/pproenca/dot-skills/openai-codex-rust-patterns"><img src="https://agentmods.dev/badge/skills/pproenca/dot-skills/openai-codex-rust-patterns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pproenca/dot-skills/openai-codex-rust-patterns"><img src="https://agentmods.dev/badge/skills/pproenca/dot-skills/openai-codex-rust-patterns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00155 | $0.03505 |
| Opus 5 | $0.00077 | $0.01752 |
| Sonnet 5 | $0.00031 | $0.00701 |
| Haiku 4.5 | $0.00015 | $0.00350 |
Grade A, and why
openai-codex-rust-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenAI Codex Rust Best Practices
Distilled from openai/codex codex-rs/ — a 119-crate, 2,008-file Rust workspace that ships the Codex CLI coding agent. Contains 63 rules across 11 categories, each citing the exact file in codex-rs where the pattern lives, so you can write Rust the way its top contributors (Michael Bolin, jif-oai, Ahmed Ibrahim, Eric Traut, Pavel Krymets) actually ship it. Citations were refreshed against main at commit 8a94430 (2026-05-25).
When to Apply
Reference these guidelines when:
- Writing or reviewing async Rust code that spawns tokio tasks, owns cancellation tokens, or manages long-lived background workers.
- Designing error enums,
Resultflows, retry loops, or layer boundaries in a library or service. - Building a CLI tool that spawns subprocesses, enforces sandboxing, or runs LLM-generated code safely.
- Architecting a Cargo workspace with more than ~5 crates, deciding what to split out, and how to manage shared dependencies.
- Adding tests to a Rust codebase where existing tests are inline
mod tests { ... }blocks and scaling is becoming painful. - Implementing a JSON-RPC or custom wire protocol with serde — especially one that must evolve without breaking clients.
- Reading API keys or other secrets into memory, or hardening a binary that handles credentials against core dumps, debugger attach, and
LD_PRELOAD. - Enforcing a network egress allowlist that must survive DNS rebinding, or loading untrusted plugins/extensions.
- Wiring OpenTelemetry traces, logs, or metrics into a service that has privacy constraints around PII.
- Building a Ratatui-based TUI that streams LLM output, handles paste bursts, or manages raw-mode terminal state.
- Any time you find yourself reaching for
.unwrap(),.lock().unwrap(),anyhow::Result<()>, or#[cfg(feature = "test")]— this skill explains what codex does instead.
Rule Categories by Priority
| Priority | Category | Impact | Prefix |
|---|---|---|---|
| 1 | Defensive Coding & Panic Discipline | CRITICAL | defensive- |
| 2 | Error Handling & Result Discipline | CRITICAL | errors- |
| 3 | Async, Concurrency & Cancellation | HIGH | async- |
| 4 | Sandboxing & Process Isolation | HIGH | sandbox- |
| 5 | Secrets & Process Hardening | HIGH | secrets- |
| 6 | Type Design & Invariants | HIGH | types- |
| 7 | Testing Architecture | MEDIUM-HIGH | testing- |
| 8 | Protocol & Serde Design | MEDIUM-HIGH | proto- |
| 9 | Workspace & Crate Organization | MEDIUM | workspace- |
| 10 | Observability & Tracing | MEDIUM | otel- |
| 11 | TUI (Ratatui) Rendering | MEDIUM | tui- |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- AGENTS.md 15 KB
- gotchas.md 2.4 KB
- metadata.json 1.0 KB
- README.md 4.7 KB
- references/_sections.md 4.1 KB
- references/async-abort-on-drop-handle.md 2.2 KB
- references/async-biased-select-for-cancellation.md 1.7 KB
- references/async-bounded-vs-unbounded-channel-split.md 1.8 KB
- references/async-child-cancellation-tokens.md 2.2 KB
- references/async-graceful-then-forceful-cancel.md 1.9 KB
- references/async-shared-boxfuture-joinhandle.md 1.9 KB
- references/defensive-banned-interpreter-prefixes.md 2.0 KB
- references/defensive-canonicalize-approval-cache-key.md 2.2 KB
- references/defensive-debug-assert-with-early-return.md 1.6 KB
- references/defensive-deny-unwrap-workspace-wide.md 1.7 KB
- references/defensive-fault-isolate-plugin-load.md 2.2 KB
- references/defensive-head-tail-output-buffer.md 2.4 KB
- references/defensive-io-drain-timeout-grandchildren.md 2.3 KB
- references/defensive-recover-poisoned-lock.md 1.9 KB
- references/defensive-refuse-to-run-unsandboxed.md 2.0 KB
- references/errors-boundary-error-translator.md 2.6 KB
- references/errors-carry-retry-delay-in-variant.md 1.9 KB
- references/errors-exhaustive-retryable-match.md 2.1 KB
- references/errors-io-error-with-context-struct.md 2.4 KB
- references/errors-struct-display-payload.md 2.3 KB
- references/errors-tool-call-respond-vs-fatal.md 2.3 KB
- references/errors-transient-permanent-type-split.md 1.9 KB
- references/otel-field-empty-then-record.md 2.8 KB
- references/otel-instrument-at-trace-level.md 2.7 KB
- references/otel-layered-subscribers-env-filter.md 2.9 KB
- references/otel-log-only-vs-trace-safe-targets.md 2.4 KB
- references/otel-w3c-traceparent-propagation.md 3.2 KB
- references/proto-double-option-tri-state.md 2.3 KB
- references/proto-experimental-runtime-gate.md 2.5 KB
- references/proto-internal-vs-wire-error-split.md 3.0 KB
- references/proto-internally-tagged-rpc-dispatch.md 2.6 KB
- references/proto-removed-feature-tombstone.md 1.9 KB
- references/proto-rename-alias-wire-migration.md 1.9 KB
- references/proto-sse-idle-timeout-terminator.md 2.4 KB
- references/sandbox-argv0-multiplex-binary.md 2.1 KB
- references/sandbox-dev-null-first-missing-mount.md 2.3 KB
- references/sandbox-env-clear-pre-exec.md 2.2 KB
- references/sandbox-resolve-before-allow-dns-rebinding.md 2.1 KB
- references/sandbox-shared-policy-data-model.md 2.3 KB
- references/sandbox-staged-restrictions-re-exec.md 2.2 KB
- references/sandbox-three-layer-network-isolation.md 2.7 KB
- references/secrets-ctor-pre-main-hardening.md 2.1 KB
- references/secrets-manual-debug-elide.md 1.8 KB
- references/secrets-read-into-locked-buffer.md 2.2 KB
- references/testing-atomic-bool-test-opt-in.md 2.3 KB
- references/testing-insta-snapshot-tui-rendering.md 2.5 KB
- references/testing-path-attribute-sibling-tests.md 1.9 KB
- references/testing-paused-runtime-advance.md 2.4 KB
- references/testing-wiremock-sse-fakes.md 2.3 KB
- references/tui-drop-guard-panic-hook-chain.md 2.3 KB
- references/tui-event-broker-pause-resume.md 2.5 KB
- references/tui-paste-burst-state-machine.md 2.7 KB
- references/tui-schedule-frame-coalescer.md 2.6 KB
- references/tui-two-gear-hysteresis-chunking.md 2.2 KB
- references/types-non-exhaustive-public-enums.md 2.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 163 lines · 155 tokens per session scan A bd902891eb55
openai-codex-rust-patterns is a skill published in the GitHub repository pproenca/dot-skills (205 stars, last pushed 24d ago), licensed MIT. It adds 155 tokens to every session and 3,505 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
dd-code-generation
Use pup CLI for immediate Datadog operations or generate code for integration into applications.
omh-rust
This is a Hermes-native rust workflow skill.
bevy-ecs
Structure a Bevy app around its Entity Component System: build the App with plugins, define Component/Resource types, write systems with Query/Res/Commands, filter and order systems, and use the Time resource for frame-rate-independent motion. Use when building or debugging a Bevy game in Rust — when the user mentions…
rust-project
Modern Rust project architecture guide for 2025. Use when creating Rust projects (CLI, web services, libraries). Covers workspace structure, error handling, async patterns, and idiomatic Rust best practices.
gcs-rust-download-object-api
Fix "DownloadObjectRequest not found" error in google-cloud-storage Rust crate. Use when: (1) Trying to download objects from GCS using the Rust SDK, (2) Looking for a download request type in http::objects::download module, (3) Compile error about missing type. The downloadobject method uses GetObjectRequest from the…
azure-keyvault-secrets-rust
Client library for Azure Key Vault Secrets — secure storage for passwords, API keys, and other secrets.