
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@daominhhiep/codex-kit
Advanced tools
Codex kit with reusable skills, subagents, workflows, and a project scaffold CLI.
Codex-native starter kit with scaffolded docs, skills, workflows, agents, plugin support, and local skill management.
Codex Kit helps you bootstrap a repository that already knows how to work with Codex.
Instead of rebuilding the same operating layer in every project, you get a ready-to-use scaffold with routing docs, a shipped skill catalog, workflow playbooks, focused subagents, Codex config, and update/status commands.
npx @daominhhiep/codex-kit init
Or install globally:
npm install -g @daominhhiep/codex-kit
codex-kit init
Initialize into a specific directory:
npx @daominhhiep/codex-kit init --path ./my-project
AGENTS.md, ARCHITECTURE.md, AGENT_FLOW.md.agents/skills.agents/workflows.codex/agents.agents/.shared.codex/config.tomlcodex/rules/default.rules.codex-kit/manifest.jsonPrimary commands:
codex-kit init
codex-kit install
codex-kit install --target plugin
codex-kit install --target mcp
codex-kit install --target skills
codex-kit install --target skills --scope local
codex-kit update
codex-kit sync --target mcp
codex-kit sync --target plugin
codex-kit sync --target skills
codex-kit sync --target skills --scope local
codex-kit list --target skills
codex-kit list --target skills --query frontend
codex-kit list --target skills --scope local
codex-kit list --target plugin
codex-kit list --target mcp
codex-kit remove --target skills --scope local --skills clean-code,planning
codex-kit autoskills
codex-kit autoskills --scope local
codex-kit autoskills --dry-run
codex-kit setup-codex
codex-kit sync-codex
codex-kit status
Common examples:
codex-kit init --path ./my-project
codex-kit install --path ./my-project
codex-kit install --target plugin
codex-kit install --target mcp
codex-kit install --target skills
codex-kit list --target skills
codex-kit list --target skills --query frontend
codex-kit list --target skills --scope local
codex-kit list --target mcp
codex-kit install --target skills --scope local
codex-kit install --target skills --scope local --skills clean-code,planning
codex-kit sync --target skills --scope local --skills clean-code,planning
codex-kit remove --target skills --scope local --skills clean-code,planning
codex-kit setup-codex
codex-kit sync-codex
Legacy aliases still work:
codex-kit install --target project
codex-kit sync --target project
codex-kit list-skills
codex-kit search-skills frontend
codex-kit list-installed-skills
codex-kit install-skills
codex-kit sync-skills
codex-kit remove-skills --skills clean-code,planning
Codex Kit ships with a local Codex plugin scaffold:
plugins/codex-kit/.codex-plugin/plugin.jsonplugins/codex-kit/skills/codex-kit/SKILL.md.agents/plugins/marketplace.jsonThere are two different installation scopes:
init or plain install installs the scaffold, while install --target plugin or install --target skills add only those parts into the current repositoryinstall --target mcp writes the shipped MCP bundle into .codex/config.toml${CODEX_HOME:-~/.codex}/skillsinstall --target mcp --scope local writes the shipped MCP bundle into ${CODEX_HOME:-~/.codex}/config.tomlTo scaffold a project:
npx @daominhhiep/codex-kit init
npx @daominhhiep/codex-kit install
To install only the workspace plugin into the current project:
npx @daominhhiep/codex-kit install --target plugin
To install only the shipped project skills into the current project:
npx @daominhhiep/codex-kit install --target skills
To install the shipped MCP bundle into the project or local Codex config:
npx @daominhhiep/codex-kit install --target mcp
npx @daominhhiep/codex-kit install --target mcp --scope local
The shipped MCP bundle currently includes:
context7 for developer documentationmysql example via @benborla29/mcp-server-mysql; uncomment it only when you want to enable MySQL MCP intentionallyTo do the full local setup in one go for the current repository:
npx @daominhhiep/codex-kit setup-codex
After upgrading Codex Kit, sync both the workspace plugin and local shipped skills:
npx @daominhhiep/codex-kit sync-codex
To install the shipped skills into local Codex:
npx @daominhhiep/codex-kit install --target skills --scope local
By default, local skills are installed into:
${CODEX_HOME:-~/.codex}/skills
Inspired by midudev/autoskills, Codex Kit ships its own auto-detection command. Instead of pulling from third-party registries, it scans the project stack and installs only the relevant skills from Codex Kit's audited catalog.
npx @daominhhiep/codex-kit autoskills
npx @daominhhiep/codex-kit autoskills --scope local
npx @daominhhiep/codex-kit autoskills --dry-run
The scanner inspects package.json, pyproject.toml, Cargo.toml, go.mod, Gemfile, framework config files (Next.js, Tailwind, Playwright, Vitest, ...) and file extensions (.sh, .ps1, .tsx, ...). It also recognizes cross-stack combos such as React + Tailwind CSS, Next.js + Playwright, or FastAPI + SQLAlchemy, and adds a small "frontend bonus" (design + SEO) when a web frontend is detected.
Project-scope installs land in .agents/skills/<skill>/ next to the rest of the Codex Kit scaffold, and write a digest of the run to .codex-kit/autoskills-lock.json. Local-scope installs land in ${CODEX_HOME:-~/.codex}/skills. Pass --force to overwrite existing files; the default behavior is non-destructive.
To browse or search the shipped catalog:
npx @daominhhiep/codex-kit list --target skills
npx @daominhhiep/codex-kit list --target skills --query frontend
npx @daominhhiep/codex-kit list --target skills --scope local
The bundled plugin can also help map natural requests such as "cài skill frontend" or "liệt kê skills debug" to the right Codex Kit commands.
Codex Kit now ships a minimal execution policy template at codex/rules/default.rules.
It is intentionally narrow:
npm install or pnpm installgit push--scope localIt does not replace AGENTS.md, skills, or workflows. Those files still handle behavior and routing; codex/rules/default.rules is only for sandbox approval policy.
>=20MIT
FAQs
Codex kit with reusable skills, subagents, workflows, and a project scaffold CLI.
The npm package @daominhhiep/codex-kit receives a total of 2 weekly downloads. As such, @daominhhiep/codex-kit popularity was classified as not popular.
We found that @daominhhiep/codex-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.