Best Codex Skills in 2026: 10 Picks and How to Install Them

The best Codex skills start with the job you keep repeating

If you build web apps, install a skill that opens the app before adding another one that generates code. If a pull request is blocked, start with its failing checks. If your deliverable is a proposal, prioritize the rendered PDF. The useful question is not how many skills you can collect. It is which part of your work needs a repeatable procedure.

A skill packages instructions and supporting files around the SKILL.md standard. It can organize a workflow around available tools; it does not grant the tools or account access itself. These ten picks cover different jobs. Each has different tool and access requirements.

Pick one that removes a current bottleneck. Get a concrete output from it, then decide whether another skill belongs in the workflow.

Codex skills for browser checks, CI failures and PR reviews

1. playwright: inspect the app in a real browser

The OpenAI playwright skill drives a browser through a terminal CLI: navigate, inspect the current state, fill forms, click and capture artifacts. It requires npx. Its default job is browser interaction, not generating a Playwright test suite.

“Use $playwright to check this local signup page with missing required fields and a valid submission. Return reproduction steps and screenshots for failures. Do not change the code yet.”

One screen and a small set of expected states make a better first task than “test my whole app.” Decide what should happen before interpreting the screenshots.

2. gh-fix-ci: diagnose the failing check before changing files

gh-fix-ci retrieves PR checks and GitHub Actions logs, summarizes the failure, and proposes a repair plan. It needs gh authentication. Implementation follows explicit approval; external CI providers are outside its stated workflow.

“Use $gh-fix-ci on this PR. Show the failing job, the relevant log and a minimal repair plan. Wait for approval before editing.”

This is the pick for a blocked Actions run, not a general replacement for every debugging procedure.

3. gh-address-comments: choose the review threads to fix

gh-address-comments fetches comments and review threads on the current branch’s PR. It numbers the proposed work, asks which comments to address, and applies the selected changes. GitHub CLI access is a prerequisite.

“Use $gh-address-comments to number the review threads and explain each required change. I will choose which ones belong in this PR.”

A requested fix and a suggestion for a future redesign need not become one expanding patch.

Choose a performance guide or a design implementation workflow

4. vercel-react-best-practices: prioritize waterfalls and bundle cost

Vercel’s React skill covers React and Next.js performance, with request waterfalls and bundle size high in its rule priorities. The directory is react-best-practices; the skill’s invocation name is vercel-react-best-practices.

“Use $vercel-react-best-practices on the product listing page. Identify request waterfalls and unnecessary bundle cost before proposing changes. Preserve the existing behavior.”

Pair the rules with a browser check after an approved change. A performance guideline and evidence that the interface still works answer different questions.

5. figma-implement-design: build from an accessible design node

figma-implement-design turns Figma context into application code. It needs a connected Figma MCP and a node URL, or a selection through the desktop MCP. The workflow reuses the project’s components and tokens, then compares the implementation with the design reference.

“Use $figma-implement-design for this node. Reuse our existing controls and design tokens, then compare the rendered result with the Figma reference.”

The deliverable is code in the repository. Editing the Figma canvas is a different workflow.

Codex skills for requirements, TDD and security reviews

6. grill-me / grilling: settle assumptions before building

Matt Pocock’s grilling interviews the user in rounds, asking the questions whose prerequisite decisions have been settled. The current grill-me wrapper delegates to it. Keep the underlying skill and check the wrapper’s host-specific Skill-tool call; in Codex, explicitly invoking $grilling names the core workflow.

“Use $grilling on this invoice automation idea. Resolve the inputs, exception rules, approval step and required output before implementation.”

Use it for unresolved requirements, rather than inserting an interview into a fully specified small edit.

7. tdd: one agreed interface, one failing test, one implementation

The current tdd skill requires agreement on the public interfaces under test. Its implementation loop is red → green in small slices, not a batch of all tests followed by all code. It puts refactoring in the code-review stage and references codebase-design when the interface itself needs discussion.

“Use $tdd for cancellation. Agree on the public interface and behaviors first, then show a failing test before the minimal implementation that passes it.”

8. security-best-practices: request a scoped security review

security-best-practices covers Python, JavaScript/TypeScript and Go. It activates for explicit security work and uses language/framework guidance to identify issues and suggest improvements. Ask for the report before deciding which fixes to authorize.

“Use $security-best-practices to review login and user-data access. Identify the stack, affected files, impact and fix priorities. Do not implement fixes yet.”

Give the review a concrete target instead of treating every ordinary code review as the same task.

Match the skill to the artifact you need to hand over

9. pdf: inspect the rendered pages, not just extracted text

The pdf skill creates, extracts and reviews PDFs using Python tools and page rendering with Poppler. Visual inspection catches clipped tables, overlap and broken pagination that extracted text can miss.

“Use $pdf to build a client proposal from these materials. Render the final pages and check table boundaries, text and page numbering before delivery.”

Start with a short document whose content and layout you can both inspect.

10. vercel-deploy: request a preview, not an accidental production push

vercel-deploy defaults to a preview deployment. Production requires an explicit request. When the CLI is missing or credentials are unavailable, its alternate deploy script provides a preview URL and a claim URL.

“Use $vercel-deploy to create a preview of this project. Return the preview URL; do not deploy to production.”

This is a Vercel workflow. A server managed with nginx and systemd needs its own deployment procedure.

How to install Codex skills without confusing names and folders

For a curated skill, ask the built-in skill-installer by name. These are prompts to enter in Codex, not shell commands:

$skill-installer playwright
$skill-installer gh-fix-ci
$skill-installer pdf

For community skills, provide the actual folder URL. Repository names, folder names and invocation names are not always interchangeable.

$skill-installer Install the skill from this folder:
https://github.com/vercel-labs/agent-skills/tree/main/skills/react-best-practices

For the current grill-me wrapper and its underlying interview workflow, supply both paths:

$skill-installer Install these two skill folders:
https://github.com/mattpocock/skills/tree/main/skills/productivity/grill-me
https://github.com/mattpocock/skills/tree/main/skills/productivity/grilling

Read the contents and referenced scripts before installation, particularly external data transfer, file changes and credential use. A portable format does not make every host-specific tool call portable.

For locally authored skills, the Codex discovery documentation distinguishes repository .agents/skills from personal ~/.agents/skills. Check where your installation method placed the files rather than moving them based on an old example. If a newly installed skill does not appear, restart Codex.

Need to encode your own recurring procedure? That is a different task from selecting a package: use the guide to building a Codex skill.

Installed is not the same as ready to run

A user in a Reddit discussion about Codex skills separated browser control, the design workflow and verification. That distinction explains a common installation disappointment: the instructions exist, but the agent still lacks the browser or connection required to act.

In CLI or IDE, use /skills and an explicit $skill-name request to separate discovery from execution. For external connections, the Codex MCP guide covers the tool layer.

Build a starter stack around one repeatable outcome

Do not invoke all ten for every request. Name the input, the desired artifact and the few skills that belong in the workflow. Keep the ones that repeatedly produce something you can examine: a reproduced UI failure, a relevant CI log, an agreed test or a correctly rendered document.

Frequently Asked Questions