# Third Party Codex Updater

> Safely check and update GitHub-installed third-party Codex plugins and local skills. Use when the user asks to inspect, update, preserve, or automate updates for FableCodex, Ponytail, Archify, Graphify, Open Code Review, SkillOpt-Sleep, agency-router, codebase-memory-mcp, Superpowers upstream, or other third-party Codex skills/plugins without overwriting local custom work.

- Skill: `koreaben777/third-party-codex-updater` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add koreaben777/third-party-codex-updater`
- Raw SKILL.md: https://api.skillmd.com/api/skills/koreaben777/third-party-codex-updater/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: koreaben777 (https://skillmd.com/u/koreaben777)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/koreaben777/third-party-codex-updater

---


# Third-party Codex Updater

Use the bundled script first. It separates safe updates from manual-review items.

```bash
python "${CODEX_SKILLS_DIR:-${CODEX_HOME:-$HOME/.codex}/skills}/third-party-codex-updater/scripts/check_updates.py" --apply-safe
```

## Policy

- Apply automatically only when the update path is official and low-risk:
  - `codex-fable5@fablecodex`: clean local repo, fast-forward only, tests pass, then `codex plugin add`.
  - `ponytail@ponytail`: `codex plugin marketplace upgrade ponytail`, then `codex plugin add`.
- Do not auto-merge or replace:
  - `archify`, `graphify`, and `open-code-review-delegate`: compare their official versions and report manual review; do not overwrite installed skills, Graphify's tool environment, or the local OCR compatibility normalization.
  - `animation-vocabulary`, `apple-design`, `emil-design-eng`, `improve-animations`, and `review-animations`: report manual review only until an upstream source is explicitly recorded.
  - `SkillOpt-Sleep`: preserve custom branch/commit, report upstream tag and conflicts.
  - `codebase-memory-mcp`: keep a clean latest-tag clone, do not replace MCP binaries or DGX config.
  - `superpowers`: keep OpenAI-curated pinned install, clone upstream only for comparison.
  - `agency-router`: compare the six selected source roles; report manual review if they changed.
- Never delete dirty worktrees. Create new clean clone paths instead.
- Never push.
- Mask secrets; do not print raw Codex session text.

## Output

Report:

- safe updates applied
- items already current
- items blocked by dirty worktree or conflicts
- clean clone paths created
- manual review items