Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/s977043/river-review/ask-codexnpx skills add s977043/river-review --skill ask-codexgit clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/river-review/ask-codex)<a href="https://agentmods.dev/skills/s977043/river-review/ask-codex"><img src="https://agentmods.dev/badge/skills/s977043/river-review/ask-codex.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.00849 |
| Opus 5 | $0.00046 | $0.00425 |
| Sonnet 5 | $0.00018 | $0.00170 |
| Haiku 4.5 | $0.00009 | $0.00085 |
Grade A, and why
ask-codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Delegate a focused question or review to Codex (OpenAI's CLI) and relay its answer back to the user as an independent, attributed second opinion.
This skill does not replace your own judgment — it gathers Codex's view so the user can compare it against yours (and against other reviewers such as Antigravity).
How Codex is invoked
The repository ships a project-local Codex config (.codex/config.toml) and a
wrapper script. Always call Codex through the script so the project config and
working directory are correct:
npm run codex:exec -- "<prompt>"
This runs codex exec non-interactively (CODEX_HOME=.codex, -C <repo root>)
and prints Codex's answer to stdout. Codex runs in the repo, so it can read
files itself — reference paths in the prompt instead of pasting large files.
Steps
-
Frame the prompt. Turn the user's request into a single self-contained prompt for Codex. Include:
- the role ("You are a senior reviewer of River Review …"),
- the file paths Codex should read (e.g.
docs/development/1255-…md,runners/core/review-runner.mjs), - the specific questions to answer, numbered,
- a request to be concise and to state a clear conclusion.
-
Run Codex with a generous timeout (design reviews can take minutes). Set the timeout on the Bash tool call itself (e.g.
timeout: 600000ms) — do not prefix the command withtimeout 600: macOS ships no GNUtimeoutbinary, so that prefix fails withcommand not found.npm run codex:exec -- "<prompt>" -
Handle authentication failure. If the output contains
401 Unauthorized/Missing bearer/Reconnecting..., Codex is not authenticated. Do not retry blindly. Tell the user to authenticate themselves in this session (these are interactive / secret-bearing and you cannot run them for them):! CODEX_HOME="$(git rev-parse --show-toplevel)/.codex" codex login(theCODEX_HOMEprefix is required — a barecodex loginwrites credentials to~/.codexand the project-local config keeps failing), or- set
OPENAI_API_KEYin the environment (warn that pasting a key into chat leaves it in history; prefer env/keychain). Then offer to re-run once authenticated.
-
Relay faithfully. Quote or summarize Codex's answer and attribute it to Codex ("Codex の見解:"). Keep Codex's conclusion distinct from your own. If you disagree, say so separately — do not silently overwrite its opinion.
-
Persist when useful. For design decisions, offer to record Codex's verdict in the relevant memo / issue / PR so it is not lost.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 72 lines · 92 tokens per session scan A e816d075eeaa
ask-codex is a skill published in the GitHub repository s977043/river-review (3 stars, last pushed today), licensed MIT. It adds 92 tokens to every session and 849 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
logic-review
Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this…
run-iteration-eval
Run the Logic-Lens content-eval pipeline for one iteration and produce a scored summary.json — use to measure a skill change. Wraps scripts/run-content-evals.sh (runner, costs tokens) and scripts/grade-iteration.py (grader, free, re-runnable). ALWAYS sync the plugin cache first. Use when the user wants to "run the…
logic-health
Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where…
sync-skill-cache
Sync the Logic-Lens working-copy skills/ into the installed plugin cache so content-evals test the EDITED skill, not the last published one. ALWAYS run this after editing any skills//SKILL.md or guide/shared file and BEFORE running content-evals — otherwise the eval silently grades stale content and every token is…
bump-version
Bump the Logic-Lens version across all six metadata locations at once (package.json, the four plugin manifests, and the README badge), then validate. Use when cutting a release or when npm run validate reports a version mismatch.
iterate-skill
Run the Logic-Lens skill-improvement loop end to end — baseline → diagnose failures → edit → sync cache → re-eval → verify net gain → iterate until clean. Use whenever the goal is to RAISE a skill's eval score or fix a failing eval mode: "improve logic-review", "the format compliance is failing, fix it", "iterate on…