Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add timurgaleev/vibestack --skill codexgit clone --depth 1 https://github.com/timurgaleev/vibestackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/timurgaleev/vibestack/codex)<a href="https://agentmods.dev/skills/timurgaleev/vibestack/codex"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/codex/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/timurgaleev/vibestack/codex"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/codex.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.19964 |
| Opus 5.5 | $0.00012 | $0.07986 |
| Sonnet 5.5 | $0.00006 | $0.03993 |
| Haiku 4.5 | $0.00003 | $0.01996 |
Grade C, and why
codex scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
mkdir -p "$_VT" && chmod 700 "$_VT" || { echo "Not run: cannot create $_VT for the prompt file." >&2; exit 1; } Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **`error`** or anything else — stop: "Codex failed a one-word probe. The usual cause is a `model =` pin in `~/.codex/config.toml` this account cannot reach (see Error Handling). Run `vibe-codex-probe --refresh` after f How it starts
The opening of the file, as written. The whole thing — 1,378 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to invoke
Use when asked to "codex review", "codex challenge", "ask codex", "second opinion", or "consult codex".
Preamble
eval "$("${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-slug" 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
"${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-learnings-search" --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi
{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
/codex — Multi-AI Second Opinion
You are running the /codex skill. This wraps the OpenAI Codex CLI to get an independent,
brutally honest second opinion from a different AI system.
Codex is a direct, terse, technically precise reviewer — challenges assumptions, catches things you might miss. Present its output faithfully, not summarized.
Step 0.4: Check codex binary
CODEX_BIN=$(command -v codex 2>/dev/null || echo "")
[ -z "$CODEX_BIN" ] && echo "NOT_FOUND" || echo "FOUND: $CODEX_BIN"
If NOT_FOUND: stop and tell the user:
"Codex CLI not found. Install it: npm install -g @openai/codex or see https://github.com/openai/codex"
Step 0.5: Nesting probe + usability probe + version check
Before building expensive prompts, verify this session is not already running inside Codex, that Codex actually answers, and that the installed CLI version isn't in the known-bad list.
Running-under-Codex probe. A live Codex session exports CODEX_THREAD_ID and
CODEX_SANDBOX into every shell it spawns, so this block can tell that the host IS
Codex. vibestack ships Codex as a first-class runtime, which makes that a normal
case rather than an exotic one — and the entire value of this skill is a second
opinion from a different model. Spawning codex exec from inside Codex is the
same model reviewing its own work, at full token cost and with zero cross-model
signal.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +22 lines · -37 tokens per session 789499f2913d
- 8d ago Changed · +456 lines scan B → C 0978b5709613
- 1mo ago Changed · +173 lines scan A → B 952bf8056825
- 1mo ago First seen · 727 lines · 66 tokens per session scan A ad112646f539
codex is a skill published in the GitHub repository timurgaleev/vibestack (7 stars, last pushed yesterday), licensed MIT. It adds 29 tokens to every session and 19,964 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sage-review
Deep, platform-neutral code review for PRs and CRs in ONE thorough single pass — design reasoning (Problem Worth Solving & Solution Fit) as one dimension alongside the 9 code-level dimensions, with chain-of-consequences, self-critique, and draft-only comments. The single app-owned source of truth.
learn-from-sage
Detection-gap (miss) analysis for Code Review Sage. Learn from shipped fixes, acted-on human comments, and design outcomes to close reviewer blind spots. Inline during review stages a candidate; a human triggers a one-shot AI consolidation into the live ruleset.
kiro-review
Review a task implementation against approved specs, task boundaries, and verification evidence. Use after an implementer finishes a task, after remediation, or before accepting a task as complete.
kiro-validate-design
Interactive technical design quality review and validation.
kiro-validate-gap
Analyze implementation gap between requirements and existing codebase.
code-review-bar-raising
Applying Amazon's raise-the-bar principle to every code review. What reviewers look for — clarity, correctness, design, reuse, operational readiness. "Ship It" means the change raises or maintains the quality bar.