Install
$ agentstack add skill-zjp1997720-codex-skill-admin-codex-skill-admin ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Codex Skill Admin
Use Codex's official skill config API. Do not edit SKILL.md frontmatter to disable a skill, and do not uninstall plugins unless the user explicitly asks for uninstall.
Quick Start
Use the bundled script for normal work:
SKILL_DIR="${CODEX_SKILL_ADMIN_DIR:-$HOME/.agents/skills/codex-skill-admin}"
if [ ! -d "$SKILL_DIR" ]; then
SKILL_DIR="${CODEX_HOME:-$HOME/.codex}/skills/codex-skill-admin"
fi
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" list --cwd "$PWD"
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" audit-unused --cwd "$PWD" --days 30
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" disable-unused --cwd "$PWD" --days 30
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" disable-unused --cwd "$PWD" --days 30 --apply
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" disable-unused --cwd "$PWD" --days 10 --max-uses 2
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" verify --cwd "$PWD"
The script starts a temporary localhost codex app-server, calls:
skills/listskills/config/write
It saves apply-mode backups under:
${CODEX_HOME:-$HOME/.codex}/backup/skill-disable-unused-YYYYMMDD-HHMMSS/
Workflow
- Run
listto get the current total, enabled, and disabled counts. - Run
audit-unused --days 30to inspect high-confidence recent usage. - Optionally add
--max-uses Nto include low-frequency skills. Example:--days 10 --max-uses 2targets enabled skills used in at most 2 distinct recent session/source files. - Run
disable-unused --days 30without--applyand inspect the dry-run output. - If the user asked to close unused or low-frequency skills, run
disable-unused --apply. - Verify with
verify, or withlist --force-reloadplusprompt-count. - Report counts, backup path, threshold parameters, and any limits of the usage evidence.
System skills are preserved by default. Use --include-system only when the user explicitly asks to consider system skills too.
The Codex desktop Skills tab count is a total discovered skill count. It is expected to stay unchanged after disabling skills. Treat enabledCount and availableSkillCount as the token-load success metrics.
Usage Evidence
The audit is intentionally conservative:
- Count actual
SKILL.mdreads from recent Codex session tool calls. - Count OMO dynamic session fingerprints that include
SKILL.md. - Count usage as distinct evidence source/session files, so repeated reads inside one session do not inflate
usageCount. - Ignore always-loaded "Available skills" lists, because they are not usage.
This is local evidence, not the product Profile page's server-side analytics.
If the same skill appears through multiple equivalent paths, set path aliases before auditing:
export CODEX_SKILL_ADMIN_PATH_ALIASES="/old/root=/new/root"
Use the platform path separator for multiple aliases.
Verification
After an apply run:
- Run
verify --cwd "$PWD". - Confirm
enabledCountdropped and target skills appear inlist --force-reload --disabled. - Confirm
availableSkillCountdropped versus the pre-run count when disabled skills were previously prompt-visible. - Ignore the desktop UI tab count for token savings; it counts total discovered skills, including disabled ones.
- If the result is wrong, run
restore --backup-dirusing the backup path from the apply output.
Backup files include local skill paths and usage evidence. Treat them as private machine-local diagnostics.
Restore
Restore a previous disable run:
SKILL_DIR="${CODEX_SKILL_ADMIN_DIR:-$HOME/.agents/skills/codex-skill-admin}"
if [ ! -d "$SKILL_DIR" ]; then
SKILL_DIR="${CODEX_HOME:-$HOME/.codex}/skills/codex-skill-admin"
fi
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" restore --backup-dir "${CODEX_HOME:-$HOME/.codex}/backup/skill-disable-unused-YYYYMMDD-HHMMSS"
Direct Set
Use set for specific skill toggles only after listing or otherwise confirming the target name/path:
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" set --name codex-skill-admin --no-enabled
python3 "$SKILL_DIR/scripts/codex_skill_admin.py" set --name codex-skill-admin --no-enabled --apply
Without --apply, set prints a dry run and writes nothing.
Manual Protocol Notes
Read references/app-server-protocol.md only when the script fails or the Codex app-server protocol changes.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: zjp1997720
- Source: zjp1997720/codex-skill-admin
- License: MIT
- Homepage: https://github.com/zjp1997720/zhijian-skills/tree/main/skills/codex-skill-admin
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.