Add support for explicit-only skill injection

What variant of Codex are you using?

CLI v0.117

What feature would you like to see?

Add an explicit-only / non-auto-injected mode for skills before (or alongside) the removal of custom prompts.

Skills are not a true superset of custom prompts for one important workflow: custom prompts were user-controlled, while enabled skills are automatically injected into context and may be invoked by the model without an explicit user action.

That difference becomes a real regression now that custom prompts have been removed in 0.117.0+.

Why this matters:

• Users were told to migrate custom prompts to skills.
• In practice, that migration is not behaviorally equivalent when the prompt was meant to be invoked only by explicit user intent.
• This is especially important for destructive or high-impact workflows where implicit invocation is unacceptable, even if the skill itself is technically valid.

Current fallback is poor:

• disable skills globally
• in every session, re-enable or manually point the agent at a path
• tell the agent to go inspect some skill file instead of using a simple /prompt-style invocation

That is materially worse than the old UX and not a realistic replacement for many existing prompt libraries.

Requested fix:

• Add a first-class skill control that prevents automatic context injection / implicit invocation.
• It could be config-level, frontmatter-level, or per-skill metadata, but it needs to be explicit and user-controlled.
• Example shapes: auto_inject = false, disable-model-invocation = true, or similar.
• This should make a skill behave like the old custom prompt workflow: only included when the user explicitly invokes it.

Why a new issue instead of only using the existing ones:

• #14459, #15939, #15980, and #15941 are mostly framed as prompt disappearance/failure regressions.
• #10585 discusses implicit skill invocation, but mostly as a theoretical concern before custom prompts were actually removed.
• Now that custom prompts are gone, the lack of an explicit-only skill mode is no longer theoretical; it blocks a real migration path.

Additional information

Related issues:

• #14459 Codex.app on macOS no longer shows custom prompts from ~/.codex/prompts
• #15939 Regression after update: custom slash commands disappear and local custom skills are missing from /skill list
• #15980 codex-cli 0.117.0 ignores custom prompt list in app-server TUI...
• #15941 Custom prompts in ~/.codex/prompts no longer appear after updating...
• #10585 Skills with implicit invocation disabled while only allowing explicit invocation

One comment on #14459 already points out the core migration problem: enabled skills are auto-injected into context and may be used without explicit user input, unlike custom prompts.
Because custom prompts were deprecated/removed before this fallback existed, users were left without a behaviorally equivalent migration path.