b-open-io/codex-agent-setup
skills/codex-agent-setup/SKILL.md
Explicit-only installer for the Sigma Auth Siggy Codex custom agent. Use ONLY when the user explicitly asks to install, update, check, uninstall, or set up the Sigma Auth or Siggy Codex agent, including "install Siggy in Codex", "update the Sigma Auth Codex agent", or "check sigma_auth_guide". Never auto-invoke for ordinary OAuth, authentication, Better Auth, BAP, wallet, session, passkey, or security requests.
development
Updated Jul 11, 2026
$ install --global
skillsauthnpx skillsauth add b-open-io/better-auth-plugin codex-agent-setupInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 11, 2026, 3:32 AM42.4s3 files scanned
SKILL.md
- name:
- codex-agent-setup
- description:
- >-
- disable-model-invocation:
- true
- user-invocable:
- true
- author:
- b-open-io
- version:
- 1.0.0
- explicit_invocation_only:
- true
- never_modify_global_config:
- true
Sigma Auth Codex Agent Setup
Install Siggy's generated Codex adapter as a regular file. Run this skill only after an explicit request to install, update, check, or uninstall Siggy.
Safety contract
- Default to the current project's
.codex/agents/directory. - Use
--useronly when the user explicitly requests a user-wide install. - Never edit
~/.codex/config.tomlor any global Codex configuration. - Never create plugin-cache symlinks or delete unrelated custom agents.
- Run
--checkwhen the user asks what would change.
Commands
bash "${SKILL_DIR}/scripts/setup.sh" [--check|--uninstall|--force]
bash "${SKILL_DIR}/scripts/setup.sh" --user [--check|--uninstall|--force]
bash "${SKILL_DIR}/scripts/setup.sh" --target /custom/agents/directory
The installer manages only sigma-auth-guide.toml and records ownership in
.sigma-auth-agents.json. An unmanaged collision is refused unless the user
explicitly authorizes --force.
After a successful install or update, tell the user to start a new Codex
session, then invoke Siggy using the runtime name sigma_auth_guide.
Maintainer generation
bash "${SKILL_DIR}/scripts/generate.sh"
bash "${SKILL_DIR}/scripts/generate.sh" --check
Related Skills
b-open-io/tokenpass
development
VerifiedTrustedCommunity
This skill should be used when the user asks about "TokenPass", "install TokenPass", "run TokenPass server", "TokenPass desktop app", "TokenPass API", "personal identity server", "be your own OAuth provider", or needs help setting up, configuring, or integrating TokenPass Server or Desktop applications. Provides installation, configuration, and API integration guidance.
SKILL.mdUpdated Apr 3, 2026
b-open-io/setup-nextjs
tools
VerifiedTrustedCommunity
Setup Sigma Auth OAuth integration in a Next.js application. Guides through installing @sigma-auth/better-auth-plugin, configuring environment variables, creating auth client, implementing sign-in flow, and setting up API routes for token exchange with Bitcoin-native authentication.
SKILL.mdUpdated Apr 3, 2026
b-open-io/setup-convex
tools
VerifiedTrustedCommunity
Setup Sigma Auth OAuth integration in a Convex application. Guides through installing @sigma-auth/better-auth-plugin, configuring Convex environment variables, and setting up the auth server.
SKILL.mdUpdated Apr 3, 2026
b-open-io/device-authorization
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "implement device auth", "add device authorization", "authenticate desktop app", "authenticate CLI tool", "device code flow", "RFC 8628", "poll for token", "get user info after device auth", or mentions authenticating apps that can't handle browser redirects. Provides step-by-step guidance for device authorization with Sigma Identity.
SKILL.mdUpdated Apr 3, 2026