Agent Skills, Claude Code, and Codex: The Trio That Changed My Diffs

By Muhammad Kashif · Draft · AI automation & cybersecurity builder, Pakistan

Agent Skills turned Claude Code, Codex, and Cursor from three chat boxes into something closer to a small team with a shared plan. The repo that crossed sixty thousand GitHub stars — twenty-four skills, seven commands, four agents that plan, ask questions, and self-test — is the shape I now expect before I trust a long unattended run on anything that touches a client repo.

Why layoffs and three-hour tickets share a slide

TCS cutting twelve thousand mid and senior roles shared the news cycle with shops that compressed three-week engineering tasks into roughly three hours. Autonomous agents — Codex, Google Jules — and AI rewriting legacy Java sat in the "next phase" column of the same notes, as if the spreadsheet and the demo were the same story.

I do not celebrate the headcount slide. I redesign the job toward harness design, evaluation, and security review — work that still needs a named human. When a client asks me to "replace a team with agents," I rewrite the ask into "compress the tedious middle while keeping accountability," and I wait to see if they still want the meeting.

What skills changed in my diffs

Skills force the agent to plan, ask clarifying questions, and self-test before it declares done. The polished end-to-end build in the notes is less interesting than the intermediate questions the agents asked. That questioning habit is what I port even when I am not on that exact repo or star count.

I keep a skill file per recurring job, a command that loads it, and an agent role that may not skip tests. Skills live in git. Chat memory does not. When a test command changes, the skill changes in the same pull request so the harness cannot silently drift.

Picking a primary harness per repo

Claude Code for long agentic sessions with tight project memory. Codex when I want cloud jobs, reviews, and SDK hooks into existing pipelines. Cursor when I am inside the editor and need inline diffs with repo rules staring me in the face. Windsurf stays in the comparison set for teams already there.

I pick one primary harness per repository on purpose. Dual harnesses without a shared AGENTS.md is how style guides fork overnight and nobody notices until Friday's review when two agents have invented two dialects of "clean."

The brief I paste before any skill run

Goal artifact. Allowed tools. Forbidden actions. Test command. Time box. If the skill cannot see the real test suite, it is not allowed to claim green. Self-testing agents that invent their own soft checks are just confident narrators with a bash prompt.

I pin model id and skill version in the PR body. Future me deserves to know which brain wrote the diff when something subtle breaks three weeks later and the chat history is gone.

Starting small on client repos

Three skills only at first: plan-and-ask, run-tests, and security-pass. More skills arrive after those three are boringly reliable for two weeks. Skills that rot teach yesterday's wrong lesson with confidence — worse than having none, because they look official.

I also schedule a monthly skill audit: delete anything unused, tighten anything that started improvising outside its lane. Speed without a definition of done is unfinished work with better marketing copy.

Where autonomous agents still lose me

Jules-style cloud agents and long Codex jobs earn trust only after they survive my golden set. Golden set means failing tests I wrote before the demo, not vibes from a happy path recorded once on a good network day.

If the agent cannot explain a failing test in plain language, it does not get another retry budget. Endless retries are how cloud bills become horror stories and how flaky fixes land in main.

What I sell from this cluster

Not "we installed Agent Skills." I sell a harness review, a skill pack for the client's top three recurring jobs, and a threat model for tool permissions. The star count is a citation. The deliverable is a repo that behaves when I am asleep.

Clients who only want the star-count story get a workshop. Clients who want the harness get a retainer that includes the audit. I stopped mixing those two offers after one project tried to be both and became neither.

Friday checklist

Skills still in git? Tests still the real suite? Primary harness still one? PR bodies still pinning versions? If any answer is no, I fix that before I add a fourteenth skill that nobody asked for.