codex-control-pack

A guide for maintaining and auditing SCR Codex control files, such as prompts, automatic instructions, hooks, rules, skills, and phase-runner records.

In plain words
What is it for?
Reviewing control-file changes and checking prompts, injections, hooks, skills, and phase-runner receipts.
Why use it?
It helps keep the files that control an agent's behavior consistent and auditable.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/recursiveintell/gloss/codex-control-pack
Any agent
npx skills add RecursiveIntell/Gloss --skill codex-control-pack
Clone the repo
git clone --depth 1 https://github.com/RecursiveIntell/Gloss

Made for: Claude Code, Codex.

Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 184 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin unknown No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00032 $0.00184
Opus 5 $0.00016 $0.00092
Sonnet 5 $0.00006 $0.00037
Haiku 4.5 $0.00003 $0.00018

Measured 2d ago against content hash 46f93ef95a52, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

codex-control-pack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/codex-control-pack/SKILL.md · 15 lines

The source is not reproduced here

Licensed AGPL-3.0

The repository is licensed AGPL-3.0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.

Read it on GitHub

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 15 lines · 32 tokens per session scan A 46f93ef95a52

Subscribe to this mod's changes

codex-control-pack is a skill published in the GitHub repository RecursiveIntell/Gloss (44 stars, last pushed 8d ago), licensed AGPL-3.0. It adds 32 tokens to every session and 184 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

my-wiki

Manage local OKF-compatible Markdown My Wiki vaults with an AI agent. Use for capturing webpages, PDFs, Office documents, notes, images, folders, and ZIP bundles as References; maintaining Reference-to-Concept evidence links; searching or answering from a vault; checking or repairing vault health; switching among…

NimaChu/my-wiki · 78 tokens

update-changelog

Update Starcat changelog documents in supports/starcat-pro/ by reading ALL git commits from the main Starcat project and generating categorized release notes in both English and Chinese. Use this skill whenever the user wants to update changelog, release notes, update records, or sync the changelog with recent…

starcat-app/Starcat · 96 tokens

starcat-localization-sync

Starcat 本地化生产、同步与发布门禁流程。用于同步 Localizable.xcstrings 与 supports/starcat-localization 的 xcloc、生成或修复 AI 初稿、人工审核或维护者明确接受 AI 翻译、导入已批准翻译、审计 18 种语言、调整 draft/released、扩展 AppLocale,以及排查 key、状态、占位符、技术字面量、UI 或 RTL 问题。.

starcat-app/Starcat · 105 tokens

starcat-release

Starcat macOS App 专用双渠道发版流程。用于用户要发布或排查 App Store archive、Direct 分发、DMG 打包、Sparkle appcast 生成或上传、starcat.ink 官网与 changelog 部署、notarization、公版 tag 处理,或询问 scripts/package-appstore.sh、scripts/release-direct.sh、scripts/package-direct.sh、legacy release-store.sh 应该如何选择和运行的场景。.

starcat-app/Starcat · 100 tokens

starcat-weekly-import

从新闻摘要、项目清单、文章或其他批量文本中联网甄别并识别真实 GitHub 仓库,搜索和核验 owner/repo,向用户展示证据并在明确确认后,通过 starcat-weekly-api 批量写入 Weekly 的受控人工来源。未明确说明测试时,固定使用生产服务 https://starcat-weekly-api.fly.dev,并从 supports/starcat-weekly-api/.env 的 ADMINAPIKEYS 读取管理员 Key。用户提到 AI 情报采集、从新闻标题找 GitHub 项目、从文本找 GitHub 地址、批量录入 Starcat Weekly、解析项目清单或补全缺失仓库链接时使用。.

starcat-app/Starcat · 157 tokens

starcat-cli-release

Starcat CLI 与 Homebrew Formula 联动发版流程。用于用户要准备、执行或排查 starcat-cli 的稳定版/预发布版,更新 CHANGELOG、运行 Go 发布门禁、创建版本 tag、触发 GitHub Release、验证多平台产物与 attestations,或确认 homebrew-starcat-cli Formula 和 Audit Action 是否同步成功的场景。.

starcat-app/Starcat · 85 tokens