Skills with implicit invocation disabled while only allowing explicit invocation

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #10573
• #8713

Powered by Codex Action

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

https://github.com/openai/codex/issues/10573

No, it's not.
This is a question issue asked by me in the past.

https://github.com/openai/codex/issues/8713

Similar but not the same. I believe my issue is valid because:

• My issue wants to solve and concentrates on the situation where custom prompts has been deprecated recently in favor of skills. #8713 is a feature request unrelated to this deprecation.

• #8713 proposes a new syntax for skill metadata and thus was redirected to an issue of Agent Skills spec repo. My issue doesn't specify how the feature should be implemented. For example, it may be implemented as a config key in ~/.codex/config.toml, which can evolve independent of the standard.

Out of curiosity, are you seeing situations where a skill is invoked implicitly when you don't want it to be? Or is this more of a theoretical concern?

If you're seeing cases where it's being invoked implicitly when that's not desired, we'd be interested in hearing about that.

@etraut-openai
It's a theoretical concern.

I have many custom prompts which perform destructive operations such as deleting AWS resources, so I want to be 100% (not 99%) sure they are invoked only when I explicitly request so.

A workaround I come up with (but haven't tried) is to bind-mount the skills directories only when I want to use them. This would work only when, for example, codex CLI is running inside a Docker container. (Actually I do wrap codex inside a docker container and implement many safeguards (e.g. bind-mounting an empty file onto an existing .env for extra safety).)

For what it's worth, similar skill invocation/activation concerns are also noted at

https://github.com/agentskills/agentskills/issues

Some tools use disable-model-invocation: true in the frontmatter for this -- then the skill will not be auto-invoked, only if you specifically ask for it. I thought it was in the agent skills spec but apparently not.

Cursor defines it like this:

By default, skills are automatically applied when the agent determines they are relevant. Set disable-model-invocation: true to make a skill behave like a traditional slash command, where it is only included in context when you explicitly type /skill-name in chat.

One potential use-case for this functionality are skills that the agent might not be able to invoke in all environments the repository is being modified in.

For instance, an infrastructure type repo could have a skill for planning/previewing the changes (ie Terraform Plan), but it requires SRE type credentials to be discoverable in the environment. This is not a skill you would want the model to automatically try to invoke if it's running somewhere like Codex Cloud, but it is a skill you would want to manually invoke from Codex CLI running on your laptop.

This feature is already supported. See this documentation for details.

For anyone landing here from search: this is configured in the skill metadata file agents/openai.yaml, not in SKILL.md.

Example:

policy:
  allow_implicit_invocation: false

Typical layout:

my-skill/
├── SKILL.md
└── agents/
    └── openai.yaml

With that setting, the skill is not injected implicitly, but it can still be invoked explicitly via $skill-name.

I'd love it if Codex just supported the disable-model-invocation Frontmatter flag, as it's somewhat conventional and would work across other harnesses (from what I've found, this flag is currently supported on Claude Code, Gemini CLI, Cursor and Pi).

Forcing a custom openai.yaml file convention and making it Codex-specific is as-annoying as Anthropic not adopting the AGENTS.md file convention on Claude Code and forcing everyone to symlink CLAUDE.md.

codex needs to support disable-model-invocation

and also bash