The Best Codex Skills

Nine Codex skills worth knowing: three already ship with Codex, six are one command away in OpenAI's curated catalog. Each was checked by reading its actual SKILL.md. We haven't run them — this is sourcing, not a hands-on review — and the criteria are stated below the table.

One thing to know before installing anything: OpenAI's skills catalog repository is deprecated. Details in where Codex skills live on GitHub below; it doesn't stop these working today, but it changes where you should look next.

The shortlist

Provenance means something specific here. Bundled skills ship inside Codex itself — they're in the openai/codex repository, need no install, and are the highest-confidence entries on this list. Curated means the skill lives in the .curated folder of OpenAI's catalog repo: OpenAI chose to publish it there, which is a real editorial signal, but it is not a performance benchmark and several curated skills are narrow vendor integrations. There's no public install or usage telemetry for any Codex skill, so nobody — us included — can rank these by popularity.

Why each one

skill-creator and skill-installer — the two you already have. Both bundled, so $skill-creator and $skill-installer work in a fresh Codex install with nothing configured. Worth knowing they exist before you go looking for third-party tooling to do the same jobs. review-agent is bundled too, and is the current in-box option for reviewing changes.

gh-fix-ci — the strongest single-task pick. Its description scopes it tightly: use gh to inspect failing PR checks, fetch the GitHub Actions logs, summarize the failure, then "propose a fix plan and implement after explicit approval." That approval gate is written into the skill itself, which is the behavior you want from something touching CI. It's also honest about its limits — it explicitly treats non-Actions providers like Buildkite as out of scope and just reports the details URL rather than pretending to handle them. Caveat: it references a create-plan skill as an optional collaborator, and create-plan lived in the catalog's .experimental folder, which no longer exists.

gh-address-comments — the companion to it. Finds the open PR for your current branch and works through its review comments with the gh CLI. Its SKILL.md front-loads the prerequisite properly: verify gh auth status first and prompt you to authenticate rather than failing halfway through. It notes that sandboxing may block gh auth status and that the command needs escalated permissions — an unusually practical detail to find in a skill file.

playwright — browser automation without the test framework. Drives a real browser from the terminal for navigation, form filling, screenshots, and data extraction, using a bundled wrapper script so it works even when playwright-cli isn't installed globally. Its instructions are explicit that it is CLI-first and will not pivot to writing @playwright/test files unless you ask — a useful boundary, since "automate the browser" and "write me a test suite" are different requests. There's also a playwright-interactive variant in the catalog.

security-threat-model — the best-written description in the catalog. It produces a repository-grounded threat model — trust boundaries, assets, attacker capabilities, abuse paths, mitigations — written to a Markdown file. What makes it worth studying even if you never install it is the description: roughly half of it is negative triggers, spelling out that it should not fire for general architecture summaries, code review, or non-security design work. That's exactly the discipline the context budget rewards. OpenAI publishes two adjacent security skills as well, security-best-practices and security-ownership-map.

migrate-to-codex — the switching-cost skill. Migrates instruction files, skills, agents, and MCP config from another agent into Codex's own files. Its instructions are notably careful about blast radius: it will create and edit Codex artifacts (AGENTS.md, .codex/, .agents/, ~/.codex/) without asking once you've picked a target, but it explicitly will not touch the source agent's files or unrelated config entries. If you're arriving from Claude Code, this is the intended on-ramp.

pdf — the one document skill worth calling out. Handles reading, creating, and reviewing PDFs where layout actually matters, rendering pages for visual checks rather than only extracting text. Reaches for reportlab, pdfplumber, and pypdf — so expect a Python environment.

The rest of the catalog

The .curated folder held 39 skills when we enumerated it on 16 August 2026. Most of the remainder are vendor-specific integrations rather than general-purpose tools, which is why they're not on the shortlist — they're excellent if you use the product and irrelevant otherwise:

• Figma — the largest group, eight skills covering design generation, implementation, design systems, and Code Connect components
• Notion — four skills for knowledge capture, meeting intelligence, research documentation, and spec-to-implementation
• Deploy targets — vercel-deploy, netlify-deploy, cloudflare-deploy, render-deploy
• Other integrations — linear, sentry, chatgpt-apps, jupyter-notebook
• Platform and language — aspnet-core, winui-app, cli-creator
• Media — screenshot, speech, transcribe
• Workflow — define-goal, openai-docs, yeet, and hatch-pet

Where Codex skills live on GitHub

The short answer, as of 16 August 2026:

• openai/codex — the agent itself, Apache-2.0. The bundled skills live here, under codex-rs/skills/src/assets/samples. This is the repo to cite for "what ships with Codex."
• openai/skills — the curated catalog $skill-installer reads by default. Its README now opens with a deprecation notice pointing to openai/plugins. Last pushed 14 July 2026. There's no repository-level license; each skill carries its own LICENSE.txt, so check per skill before redistributing.
• openai/plugins — the stated successor, for skills distributed as plugins.

This matters because most current "best Codex skills" articles still present openai/skills as the live, canonical source with no mention of the deprecation, and several recommend create-plan from the .experimental folder — which returns a 404. If you're following a roundup published before mid-2026, verify the repo state before trusting its install commands.

For third-party skills, Codex will install from any GitHub repo — see how to install Codex skills. Because the format is the shared Agent Skills standard, many skills written for other agents work in Codex unchanged; the parts that don't travel are Codex's own agents/openai.yaml metadata.

How we chose

Weighted roughly in this order. Provenance — bundled skills first, then curated, since OpenAI has already made a publishing decision about both; a third-party skill would need to clear a materially higher bar to displace them. Description quality — we read every shortlisted skill's frontmatter, and a tightly scoped description with explicit negative triggers is the strongest available signal that a skill was built carefully. Stated safety behavior — approval gates, auth prechecks, and declared scope limits. Breadth — picks covering genuinely different jobs rather than several variations on one, which is why eight Figma skills produced no shortlist entry.

What we deliberately did not do: rank by popularity. At least one competing roundup publishes per-skill "install counts"; there is no public telemetry for Codex skill installs, so those numbers come from some third party's own registry and shouldn't be read as ecosystem-wide fact. Another recommends obra/superpowers — a large, genuinely popular framework, but one built around Claude Code, which is worth knowing before you install it into Codex.

Sources

• openai/codex — bundled sample skills
• openai/skills — the .curated catalog — every shortlisted skill's SKILL.md read directly; catalog enumerated via the GitHub API on 16 August 2026
• openai/plugins — the stated successor repository
• Codex — Build skills (official docs)