Codex Implement

A workflow for sending a well-defined GitHub issue to Codex CLI in an isolated worktree, then reviewing the resulting code with two reviewers before opening a pull request. A worktree is a separate copy of a repository's files for safe changes.

In plain words
What is it for?
Delegating GitHub issue implementation, checking the diff, running agy and Codex peer reviews, and opening a pull request with auto-squash enabled.
Why use it?
It separates implementation from supervision and adds a required review checkpoint before code is proposed for merging.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/usejunior/email-agent-mcp/codex-implement
Any agent
npx skills add UseJunior/email-agent-mcp --skill codex-implement
Clone the repo
git clone --depth 1 https://github.com/UseJunior/email-agent-mcp

Made for: Claude Code, Codex.

Per session 66 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,264 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00066 $0.06264
Opus 5 $0.00033 $0.03132
Sonnet 5 $0.00013 $0.01253
Haiku 4.5 $0.00007 $0.00626

Measured 2d ago against content hash e13813aabd8f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

Codex Implement scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Tells the agent never to refusehighAnti-refusal

Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.

**Flag, don't refuse**, when the work involves many sequential steps without a forcing function. Codex can lose track of intent across very long chains. Instrument the prompt with checkpoints ("after each subsection, res

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

<specific grep/diff/curl commands to confirm the change works on 2-3 representative cases>
.claude/skills/codex-implement/SKILL.md · 402 lines

How it starts

The opening of the file, as written. The whole thing — 402 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are running the /codex-implement workflow. The user wants you to delegate implementation of a GitHub issue to Codex CLI in headless mode, supervise the result, run a mandatory two-reviewer peer review (agy + Codex) on the diff, and then open a PR with auto-squash armed.

You are the supervisor, not the implementer. Codex writes the code; you write the prompt, validate the diff, gate on peer review, and ship.

Codex is highly capable on implementation — including large, multi-file, technically complex changes. Don't gate on raw complexity. Gate on workflow correctness (epic/spec/ambiguity) and on the kind of judgment that requires the user's own experience.

⚠️ Deprecated invocation warning. Do NOT use codex exec --full-auto. That code path (and any backgrounded codex exec invoked without an explicit stdin redirect) blocks reading stdin and hangs forever when there's no TTY attached — the process never exits, run_in_background never notifies you, and you're left with a silently-stuck review or implementation run. Every codex exec call in this skill uses --sandbox workspace-write (or --sandbox read-only for read-only reviews) plus a mandatory < /dev/null redirect. Do not drop the redirect even when a call "looks" foreground — background scheduling can happen transparently.

When to use

  • The issue has concrete acceptance criteria you can articulate as a target output.
  • You can name the files most likely to change (so Codex doesn't have to hunt).
  • You have a clean working tree (or saved/committed the changes you'd lose).

When to reserve for the user instead of delegating

  • Edge-case judgment from a decade of practice. The issue's correct solution depends on long-tail scenarios Codex will over-normalize away ("there are only five cases" when the user can trivially name a sixth from real-world experience). Includes regulatory practice nuances, customer-specific institutional knowledge, and rare-but-load-bearing edge conditions.
  • Non-formally-verifiable outcomes. The success criterion is taste, voice, or positioning — product copy, brand voice, ICP framing, sales-narrative phrasing. Codex optimizes against verifiable targets; subjective ones drift.
  • Real-world experience the long tail Codex can't find documented. Even with web search, the answer lives in the user's head from years of working a domain. Surface to the user.
  • Workflow gates (independent of Codex's capability):
    • epic-labelled issues — break into scoped sub-issues first.
    • Issues that require an OpenSpec change before implementation — handle the spec/proposal step first.
    • Issues without testable acceptance criteria — sharpen the issue first.

Read the full file on GitHub · 402 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 402 lines · 66 tokens per session scan C e13813aabd8f

Subscribe to this mod's changes

Codex Implement is a skill published in the GitHub repository UseJunior/email-agent-mcp (5 stars, last pushed 5d ago), licensed Apache-2.0. It adds 66 tokens to every session and 6,264 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (tells the agent never to refuse, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.