The best Codex skills, picked by role

How this list was chosen

A good skill earns its place by changing what Codex does, not by restating what it already knows. Every pick below fixes a failure you can observe: Codex patching a symptom instead of finding the cause, committing everything in one lump, writing tests after the fact, or loosening the sandbox to get past an error. If a skill does not change behavior you can see within a week, uninstall it.

Install picks with the one-line installer (it writes to ~/.agents/skills; add --project for the repository):

curl -fsSL https://codexskills.dev/install.sh | sh -s -- systematic-debugging implementation-planning

Keep the count sensible. Codex lists every installed skill’s name and description in a catalog limited to roughly 2% of the context window; past that, descriptions get trimmed and implicit matching suffers. A focused set of skills that trigger reliably beats a large set that does not. See what Codex skills are for how that catalog works.

Everyone: the habits worth enforcing

These apply to any language and any repository. They are the core of the Starter Pack.

• systematic-debugging. The single most useful skill for an agent. It makes Codex reproduce the bug, change one variable at a time and prove the fix, instead of editing until the error message changes. Expect fewer “fixed” bugs that come back.
• implementation-planning. For anything that touches more than a couple of files, Codex writes a plan with risks and checkpoints first. You review a page of text instead of a sprawling diff.
• test-driven-development. Red, green, refactor with an agent: a failing test that pins the behavior before production code changes. It also gives Codex an objective stopping point.
• git-commit-hygiene. Splits a messy working tree into atomic commits with messages that explain why, staging hunks without interactive prompts. Reviewers notice the difference immediately.
• code-review. Correctness first, severity labels, concrete fixes. Useful both for reviewing teammates’ diffs and for a second pass on Codex’s own work.
• codebase-onboarding. Maps entry points, data flow and conventions in an unfamiliar repository before any edits. Good first command in a new job or an inherited service.
• safe-refactoring. Behavior-preserving changes in small steps under tests, so a cleanup does not smuggle in a regression.

Codex power users: configure the agent itself

Skills about Codex rather than your code. The Codex Power User collection groups them.

• agents-md-authoring. Writes a lean AGENTS.md with the commands, conventions and boundaries Codex needs on every task. Most repositories either have none or have one that is too long; both cost you. Pair it with the AGENTS.md guide.
• codex-sandbox-approvals. Picks a sandbox mode and approval policy per task, so you stop reaching for full access to get past a blocked command.
• codex-config-toml. Sets up ~/.codex/config.toml: model, reasoning effort, sandbox defaults, profiles and MCP servers, with the current key names.
• codex-exec-ci. Runs codex exec headless in pipelines with JSON output, schemas and least-privilege settings.
• codex-context-budget. Keeps sessions lean in large repositories: what to read, when to compact, how to avoid flooding context with logs.
• skill-authoring and skill-description-tuning. Write your own skills and make them trigger when they should, and only then.

Frontend

From the Frontend Craft collection and Next.js Full-Stack:

• react-19-patterns. Actions, use(), useOptimistic and form actions. Models often fall back to older React idioms; this keeps output current.
• nextjs-app-router. Layouts, loading and error files, route handlers, and where server and client code belong.
• tailwind-v4. The CSS-first configuration and @theme. Without it, agents still write v3 config files.
• wcag-accessibility-audit. A WCAG 2.2 AA pass on pages and components with specific fixes.
• frontend-design. Pushes generated UI away from template defaults toward deliberate type, spacing and color choices.

Backend and data

From Python Backend and Ship to Production:

• rest-api-design. Consistent resources, status codes, errors and pagination across endpoints.
• zero-downtime-migrations. Expand and contract schema changes. This is the skill that prevents an agent from writing a migration that locks a large table.
• postgres-query-tuning. Reads EXPLAIN ANALYZE, proposes indexes and rewrites with evidence.
• idempotency-keys and background-jobs. Retries that do not double-charge and jobs that survive restarts.
• input-validation. Schema validation at every boundary with Zod, Pydantic or Valibot.

Testing

From Testing and Quality:

• pytest-testing or vitest-testing. Pick the one for your stack. Both fix fixture scope, isolation and slow suites.
• playwright-e2e. Stable locators, auto-waiting and traces instead of sleeps.
• flaky-test-triage. Classifies flakes by cause and fixes them rather than adding retries.

Security

From the Security Audit collection:

• secure-code-review. Traces untrusted input to dangerous sinks and reports findings with file and line evidence.
• owasp-top-10-review. A structured pass over the OWASP categories with a fixed report format.
• threat-modeling. Data flows, trust boundaries and mitigations before a feature ships.
• secret-scanning. Finds committed credentials and walks through rotation, not just deletion.
• prompt-injection-defense. Worth installing if your product feeds untrusted text to a model.

Documents and office files

From Office Documents:

• pdf-processing. Extract text and tables, split and merge.
• docx-documents. Word files with real styles rather than direct formatting.
• xlsx-spreadsheets. Spreadsheets whose formulas keep working when someone edits them.
• pptx-presentations. Slide decks generated from data.

AI engineering

From AI Engineering:

• openai-responses-api. Current request shapes, tools and streaming for the Responses API.
• openai-structured-outputs. Schema-guaranteed JSON with Pydantic or Zod, including strict-mode rules.
• llm-evals. Test sets and graders so prompt changes are measured, not guessed.
• rag-pipelines. Chunking, retrieval and evaluation for retrieval-augmented generation.

Product, writing and growth

• prd-writing. Product requirement documents with scope, non-goals and acceptance criteria.
• readme-writing and postmortem-writing. Documents people actually read.
• technical-seo-audit. Crawlability and indexation problems tied to evidence; part of SEO and Growth.

The Founder Kit collects the product and business skills for small teams.

Built-in skills you already have

Codex bundles system skills, so check these before installing anything:

• $skill-creator drafts a new skill by asking what it does, when it should trigger and whether it needs scripts. See write your first Codex skill.
• $skill-installer installs skills from OpenAI’s curated list or a GitHub path.

Run /skills in the CLI or IDE extension to see everything currently available, including system skills.

How to judge a skill before keeping it

1. Read the description. It should say what the skill does and when to use it, with words you would actually type. Vague descriptions trigger poorly.
2. Skim the body. Look for concrete commands, a definition of done and hard rules. A body that reads like a blog post will not change Codex’s behavior much.
3. Check for scripts. If scripts/ exists, read it. Scripts run on your machine, inside the sandbox and approval policy you configured.
4. Use it for a week. Then keep it or remove it. The skill not triggering guide helps when a skill you want never seems to load.