›_ Codex Issues
Codex Issues / #24189

Codex app injects incorrect .system path for user-installed skills

Open 💬 2 comments Opened May 23, 2026 by lihaiming

Summary

Codex app generated an incorrect Skills list path for a user-installed skill.

Actual skill location

C:\Users\{USERNAME}\.codex\skills\vercel-react-best-practices\SKILL.md

Injected path

C:\Users\{USERNAME}\.codex\skills\.system\vercel-react-best-practices\SKILL.md

Expected

User-installed skills should be injected with their real path under:

$CODEX_HOME\skills\<skill-name>\SKILL.md

Only built-in/system skills should be injected from:

$CODEX_HOME\skills\.system\<skill-name>\SKILL.md

Observed

vercel-react-best-practices was injected as a .system skill path, even though it is installed as a normal user skill. The agent failed to open the skill until it manually searched under $CODEX_HOME\skills.

Suggested fix

When generating the session Skills list:

  • Use the actual discovered SKILL.md path instead of reconstructing paths.
  • Validate that the emitted file: path exists.
  • Treat $CODEX_HOME\skills\.system\* as system skills only.
  • Treat $CODEX_HOME\skills\* excluding .system as user-installed skills.

Local evidence

.system contains only:

  • imagegen
  • openai-docs
  • plugin-creator
  • skill-creator
  • skill-installer

vercel-react-best-practices exists at:

C:\Users\{USERNAME}\.codex\skills\vercel-react-best-practices

Environment

  • OS: Windows
  • Codex app session
  • $CODEX_HOME: C:\Users\{USERNAME}\.codex

View original on GitHub ↗

2 Comments

yui-stingray · 3 months ago

I took a look at current origin/main (7d47056). I could not find a session-rendering or injection path that rewrites a user skill path into .system after discovery:

  • codex-rs/core-skills/src/loader.rs registers the normal user skill root separately from the embedded system-skill cache under CODEX_HOME/skills/.system.
  • codex-rs/core-skills/src/injection.rs uses skill.path_to_skills_md directly for the injected path.
  • codex-rs/core/src/context/skill_instructions.rs just carries that path into the <path> field.
  • The app-server catalog/plugin surfaces I checked also return skill.path_to_skills_md directly.

So if this repro is current, the wrong root may already be attached during skill discovery/caching, or the app may be reading a stale/cached skill entry. The most useful next artifact would probably be the raw skills/list entry for vercel-react-best-practices (especially path and scope), with local prefixes redacted or normalized to CODEX_HOME.

For the cache angle, a safer check would be: quit Codex, temporarily move/rename CODEX_HOME/skills/.system so it can be restored, then restart Codex and see whether the emitted path changes.

euri10 · 3 days ago

Fresh Linux check (2026-08-25): I cannot reproduce the incorrect .system reconstruction with Codex CLI 0.144.3.

After initialize, a direct skills/list request with forceReload: true returned this user skill:

{
  "name": "karpathy-guidelines",
  "path": "<HOME>/dotfiles/agentskills/.config/agentskills/generated/karpathy-guidelines/SKILL.md",
  "scope": "user",
  "enabled": true
}

There is no .system component. The ACP bridge used for this probe was @agentclientprotocol/codex-acp 1.6.2, but it forwards the app-server response unchanged.

This suggests the original failure was either fixed after the affected build, cached/stale metadata, or a desktop/session rendering path rather than current skills/list discovery. Preserving the original affected build's raw skills/list item (name, path, scope) would distinguish those cases.