Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add subinium/vibesubin --skill codex-fixgit clone --depth 1 https://github.com/subinium/vibesubinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/subinium/vibesubin/codex-fix)<a href="https://agentmods.dev/skills/subinium/vibesubin/codex-fix"><img src="https://agentmods.dev/badge/skills/subinium/vibesubin/codex-fix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/subinium/vibesubin/codex-fix"><img src="https://agentmods.dev/badge/skills/subinium/vibesubin/codex-fix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00154 | $0.04142 |
| Opus 5.5 | $0.00062 | $0.01657 |
| Sonnet 5.5 | $0.00031 | $0.00828 |
| Haiku 4.5 | $0.00015 | $0.00414 |
Grade A, and why
codex-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
codex-fix
A thin, deliberately host-specific wrapper for one workflow: "I've finished a batch of edits — run Codex for a second-model review, feed the findings back, let Claude resolve them with verification."
This wrapper owns only the Codex-specific glue: the host check, the templated /codex:rescue prompt, the output collection, and the hand-off. Everything after the hand-off — parsing and normalizing findings, triaging real / false-positive / defer / duplicate, mapping each finding to a commit via git blame, planning a dependency tree, executing leaves-up, verifying each fix with the applicable checks, committing with a back-reference to the review item, and producing the resolution report — belongs to refactor-verify's review-driven fix mode. This skill does not duplicate any of it.
If you are not on Claude Code with the Codex plugin installed, you do not need this skill. refactor-verify accepts pasted review findings from any source directly — this wrapper just automates the invocation step for operators who run the Codex loop often enough that the copy-paste was adding friction.
State assumptions — before acting
Before starting the procedure, write an explicit Assumptions block. Don't pick silently between interpretations; surface the choice. If any assumption is wrong or ambiguous, pause and ask — do not proceed on a guess.
Required block:
Assumptions:
- Host: <Claude Code + Codex plugin (primary path) | any other (graceful one-line fallback, exit)>
- Review branch: <current branch | specified — merge-base with main is the diff scope>
- Working tree: <clean (proceed) | dirty (warn operator before handing mixed state to Codex)>
- Base reference: <main (default) | explicit base when current branch has no merge-base with main>
Typical items for this skill:
- The branch under review (default: current branch vs its merge-base with main)
- Working tree state (clean required for a clean review; dirty triggers a warning before invocation)
- Codex plugin availability (host check in Step 1 — this Assumptions block is Step 0, the host check is Step 1)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 177 lines · 154 tokens per session scan A 03212f58058d
codex-fix is a skill published in the GitHub repository subinium/vibesubin (51 stars, last pushed 6mo ago), licensed MIT. It adds 154 tokens to every session and 4,142 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
codex-fix compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| codex-fixsubinium/vibesubin | Skill | 51 | 6mo ago | MIT | A | 154 | Claude Code |
| semgrep-rule-creatorwaybarrios/opencode-power-pack | Skill | 551 | 5d ago | MIT | A | 37 | Claude Code |
| variant-analysiswaybarrios/opencode-power-pack | Skill | 551 | 5d ago | MIT | A | 45 | Claude Code |
| fp-checkwaybarrios/opencode-power-pack | Skill | 551 | 5d ago | MIT | A | 32 | Claude Code |
| vuln-reportwaybarrios/opencode-power-pack | Skill | 551 | 5d ago | MIT | A | 44 | Claude Code |
| squid-architecture-reviewiusztinpaul/squid | Skill | 211 | 10d ago | Apache-2.0 | A | 47 | Claude Code |
| huggingface-spaceswaybarrios/opencode-power-pack | Skill | 551 | 5d ago | MIT | B | 60 | Claude Code |