Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/veithly/codex-skill/codexnpx skills add veithly/codex-skill --skill codexgit clone --depth 1 https://github.com/veithly/codex-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.01662 |
| Opus 5 | $0.00008 | $0.00831 |
| Sonnet 5 | $0.00003 | $0.00332 |
| Haiku 4.5 | $0.00002 | $0.00166 |
Grade A, and why
codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 252 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex CLI Integration
Delegate coding tasks to OpenAI's Codex CLI with configurable execution modes including YOLO mode for fully autonomous operation.
Usage
/codex <task_description> [options]
Options
--mode=yolo- YOLO mode: No approvals, no sandbox (use in hardened environments only)--mode=auto- Full auto mode: Workspace write access, minimal interaction (default)--mode=safe- Safe mode: Requires approval for each action--timeout=<seconds>- Execution timeout (default: 1800)--add-dir=<path>- Additional directory for Codex to access
Examples
# Fix a bug with default auto mode
/codex Fix the null pointer exception in src/api/handlers.ts
# Implement feature with YOLO mode
/codex --mode=yolo Implement user authentication with JWT in the express app
# Refactor with safe mode
/codex --mode=safe Refactor the database connection pool to use async/await
# Run tests and fix failures
/codex Run all tests and fix any failing ones
Context
- Task description: $ARGUMENTS
- Current working directory will be used as Codex workspace
- Git repository state should be clean before execution
Your Role
You are the Codex Orchestration Coordinator managing automated coding tasks through OpenAI's Codex CLI. You handle task translation, mode selection, execution monitoring, and result integration.
Workflow
Phase 1: Environment Verification
Before executing any Codex command, verify the environment:
# Check if Codex CLI is installed
codex --version 2>/dev/null || echo "CODEX_NOT_INSTALLED"
# Check for API key (just verify it exists, don't expose)
[ -n "$OPENAI_API_KEY" ] && echo "API_KEY_SET" || echo "API_KEY_NOT_SET"
# Check git status (ensure we can rollback)
git status --porcelain
If Codex is not installed, provide installation instructions:
npm install -g @openai/codex
# or
pnpm add -g @openai/codex
Phase 2: Task Analysis
Parse the user's arguments to determine:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 252 lines · 16 tokens per session scan A 614e2b494fc0
codex is a skill published in the GitHub repository veithly/codex-skill (1 stars, last pushed 8mo ago), licensed MIT. It adds 16 tokens to every session and 1,662 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
project-butler
Project memory workflow for init/upgrade, profile-aware setup, end session, normal/full close, file organization, document archiving, language switching, versioned update logs, rule review, status, wiki sync, and context recovery. Use for /project-butler, setup/初始化, foundation setup, profile setup, end session/收工…
vibe-check
Turn a complete beginner's app idea into a buildable plan, then keep them oriented while they build. Use it whenever someone who has never coded wants to build or "vibe code" an app, has an idea but no idea where to start, or wants it turned into a plan, MVP scope, tech stack, user flows, or blueprint. It has three…
modern-jetpack-compose
Guides writing, reviewing, and reasoning about modern Android UI code using Jetpack Compose. Covers best practices for state management, side effects, recomposition, navigation, Material 3 design, accessibility, and performance. Use when reading, writing, or reviewing any Jetpack Compose project.
pdca-framework
Guides developers through a human-supervised PDCA framework for AI code generation. Applies analysis, TDD, validation, and retrospection. Activates for sessions requiring systematic quality control.
update-changelog
Updates a project changelog with entries for changes since the branch diverged from main. Use when about to open a PR, cutting a release, or when the user asks about changelog, release notes, or migration notes.
production-audit
Audit a shipped repo for the production-readiness gaps that 70% of AI-coded projects miss. Use when the user asks "is this production-ready", "what would break in prod", "score my project", "audit my repo", or after merging a feature to main. Distinct from in-session security skills — this scans the SHIPPED state…