Reusable company workflows published as open Agent Skills for Codex and Claude Code. One plugin, company-skills, ships every skill from the company marketplace in this repository.
Both products install at user scope by default, so the skills are available in every project.
Both products cache the plugin by version, so updates arrive only when a release bumps the plugin version (see Releases).
claude plugin marketplace add cipherstash/skills
claude plugin install company-skills@companyInside a session, /plugin marketplace add cipherstash/skills and /plugin install company-skills@company do the same. Start a new session, then invoke a skill by its namespaced name, for example /company-skills:address-code-review.
To update to the latest published skills, refresh the marketplace, update the plugin, then start a new session:
claude plugin marketplace update company
claude plugin update company-skills@companycodex plugin marketplace add cipherstash/skills --ref main
codex plugin add company-skills@company
codex plugin list --marketplace companyThe command syntax was checked against codex-cli 0.160.0. Start a fresh session and use /skills or type $ to select an installed skill, then supply its inputs. address-code-review requires explicit selection; the PR feedback skills can also match requests automatically.
If your CLI does not provide plugin add, restart the desktop app, choose Company in the Plugins Directory, and install Company Skills there. See OpenAI’s plugin packaging guide for marketplace configuration.
To update, refresh the marketplace, then reinstall the plugin:
codex plugin marketplace upgrade company
codex plugin remove company-skills@company
codex plugin add company-skills@companyInstall from a clone by passing its path instead of cipherstash/skills. Use one source for the company marketplace at a time; cloning alone does not install the plugin:
claude plugin marketplace add /path/to/skills
claude plugin install company-skills@company
codex plugin marketplace add /path/to/skills
codex plugin add company-skills@companyBoth products install a cached copy, so edits in the clone are not live:
- Claude Code: run
claude plugin marketplace update company, thenclaude plugin update company-skills@company, and start a new session. If a change still does not appear, bump the plugin version in all three manifests as described in Releases. To test edits without reinstalling, start a session withclaude --plugin-dir /path/to/skills/plugins/company-skills. - Codex:
marketplace upgraderefreshes Git marketplaces only. For a local clone, runcodex plugin remove company-skills@company, thencodex plugin add company-skills@company, and start a new session.
.
├── .agents/plugins/marketplace.json # Codex marketplace
├── .claude-plugin/marketplace.json # Claude Code marketplace
└── plugins/company-skills/
├── plugin.json # Portable Agent Plugins manifest
├── .codex-plugin/plugin.json # Codex compatibility metadata
├── .claude-plugin/plugin.json # Claude Code plugin metadata
└── skills/<skill-name>/SKILL.md # Shared skill source
Each skill is authored once under plugins/company-skills/skills/. The portable manifest discovers skills/; the Codex compatibility manifest explicitly points to ./skills/; Claude Code uses the same directory. Marketplace source paths resolve from the repository root, and plugin resource paths resolve from plugins/company-skills/.
| Skill | Purpose | Invocation |
|---|---|---|
address-code-review |
Verify findings and fix confirmed defects | Explicit only |
audit-pr-feedback |
Audit existing PR feedback against the PR head | Explicit or automatic |
cross-check-review-findings |
Compare new findings with existing PR feedback and draft a response | Explicit or automatic |
vanta-triage |
Reconcile open Vanta vulnerability findings with Linear issues: file, retarget, and close | Explicit or automatic |
vanta-remediate |
Patch dependencies for Vanta Linear issues, verify every lockfile, and open PRs | Explicit or automatic |
The PR feedback skills require Python 3, Git, and gh authenticated for the target repository. These are local CLI dependencies; the plugin does not bundle an MCP server.
The Vanta skills also need the Linear connector, read-only Vanta API credentials (vanta-api.all:read) with network access to api.vanta.com for vanta-triage, either as an environment network secret of type OAuth 2.0 client credentials for api.vanta.com or as VANTA_CLIENT_ID and VANTA_CLIENT_SECRET, and each target ecosystem's toolchain (cargo, pnpm/npm/yarn/bun, go, poetry/uv) for vanta-remediate. vanta-remediate also needs the GitHub MCP server for pull requests and git push access to the target repos; it does not use the gh CLI. Both run unattended, so they suit Claude Code routines.
Follow CONTRIBUTING.md to add or change a skill: naming, progressive disclosure, required behavior cases, releases, and the validation commands to run. Pull requests run python3 scripts/validate.py, python3 -m unittest discover -s scripts/tests, and each skill's tests/ suite in GitHub Actions; the claude plugin validate --strict checks run locally only.
See the official Codex skills documentation and Claude Code plugin marketplace documentation for current publishing and installation options.
MIT