As of October 2026, Codex skills package repeatable coding workflows, while plugins bundle skills together with MCP tools for distribution. This guide selects 10 projects with clear maintainers and concrete coding purposes. They cover requirement decomposition, documentation lookup, browser acceptance, remote collaboration, frontend performance, security review, databases, and mobile development. "Must-install" here means adding the capability a current task requires, not installing all 10 at once. All star counts are snapshots read from the GitHub repository API on October 12, 2026. They measure repository attention, not the quality score of a single skill or plugin.

1. Skill, Plugin, and MCP Are Not the Same Thing

OpenAI Docs defines a Skill as a task package that carries instructions, reference material, and optional scripts. A plugin is an installation and distribution container, and it can hold multiple skills and MCP services. An MCP service gives Codex tools to reach external systems. For a team that wants Codex to follow an internal testing process, a skill is the first choice. For reading GitHub pull requests, querying external documentation, or driving a browser, the matching plugin or MCP is the right path.

The installation entry point depends on where Codex runs. According to OpenAI Docs as of October 2026, the Codex desktop app and CLI support plugins; the IDE extension does not. Standalone skills work on the desktop app, the CLI, and the IDE extension. On the desktop app, a user searches under "Plugins," installs the target, then opens a new conversation. Only a fresh session lets the new capability enter the conversation.

2. Ten High-Star Candidates and What Each One Solves

The following ten projects were selected because each maps to a distinct task type. Choosing one is not a popularity vote; it is a fit check against the current workload.

2.1 Superpowers — Sustained Feature Development

Repository: obra/superpowers. Star count on October 12: roughly 298,000. The project chains requirement clarification, planning, test-driven development, code review, and pre-completion validation into one flow. Its README provides plugin installation entry points for both the Codex desktop app and the CLI. It fits cross-file feature work and refactoring, where the extra structure keeps the process disciplined. For a single-text change, the full flow can outweigh the task itself.

2.2 Context7 — Documentation Lookup for New Repositories

Repository: upstash/context7. Star count on October 12: roughly 63,000. The project offers two access modes: a CLI plus Skill, and an MCP server. Its goal is to bring current repository documentation and examples into the coding conversation. It fits scenarios such as a just-upgraded Next.js app, a changed database SDK, or a new test framework. Teams still return to the upstream official docs to verify critical APIs. The Context7 repository itself warns that its collected content is not guaranteed to be fully accurate.

2.3 Playwright CLI — Visible Acceptance for Web Changes

Repository: microsoft/playwright-cli. Star count on October 12: roughly 14,000. It provides browser operations, screenshots, and a skill usable by agents. The README recommends the CLI plus Skill for high-frequency coding tasks, on the grounds that it consumes less context than continuously injecting a large MCP tool structure. When a task needs long-lived browser state and repeated page exploration, the same team's Playwright MCP is the alternative. Installing both by default is not recommended.

2.4 GitHub Integration — PR, Issue, and CI Handling

Repository: github/github-mcp-server. Star count on October 12: roughly 34,000. The official repository lists capabilities such as code search, pull requests, issues, and Actions workflows. The Codex plugin directory also lists a GitHub plugin. The star count belongs to the MCP server repository and cannot be read as the plugin's installation volume. This connection adds value only when work moves beyond the local repository, such as reading remote PRs or CI results.

2.5 Vercel Agent Skills — React and Next.js Support

Repository: vercel-labs/agent-skills. Star count on October 12: roughly 32,000. Among them, react-best-practices covers rules for data fetching, bundle size, rendering, and performance. It suits React component work, Next.js pages, and frontend review. For pure backend, scripting, or database tasks, there is no reason to install it just because the repository is highly starred.

2.6 Chrome DevTools MCP — Real Browser Performance Diagnosis

Repository: ChromeDevTools/chrome-devtools-mcp. Star count on October 12: roughly 53,000. The maintainer docs list performance traces, network requests, console errors, and screenshots. It suits locating slow page loads, interaction jank, and request anomalies. For validating a single button flow, the earlier Playwright CLI is usually sufficient.

2.7 Playwright MCP — Persistent Browser State for Ongoing Exploration

Repository: microsoft/playwright-mcp. Star count on October 12: roughly 38,000. The README positions it for automated tasks that need a persistent session, a rich page structure, and multi-round exploration. It is the second access mode for the same browser tooling as Playwright CLI. A team should pick one mode per task to avoid installing two overlapping browser stacks.

2.8 Trail of Bits Skills — Security Differential Review

Repository: trailofbits/skills. Star count on October 12: about 7,486. The repository gives an access command for the Codex plugin marketplace. Its differential-review capability examines code changes against Git history. It fits security checks on authentication, permission, or dependency changes. It provides a review process; it does not prove that code is free of vulnerabilities.

2.9 Supabase MCP — Database Context for Project Validation

Repository: supabase/mcp. Star count on October 12: about 2,945. The official repository describes connecting a project, viewing configuration, managing tables, and querying data. A database task should first scope the connection to a specific project and consider read-only configuration. Production write permission should never be the default grant. Projects that do not use Supabase do not need it.

2.10 Expo Skills — Mobile Workflows

Repository: expo/skills. Star count on October 12: about 2,754. The Expo team provides a Codex plugin installation method. Topics cover Expo Router, SDK upgrades, and EAS flows. Only Expo or React Native projects need it. For related APIs, the Expo docs and CLI remain the source of truth.

3. A Minimal Setup: Choose the Task, Add the Capability, Verify It

The practical order is: start with the extension that solves the immediate problem, then confirm with a real task that it actually works. Three steps form the loop:

  1. Identify the task gap. Determine whether the gap is in process, documentation, browser, or remote collaboration.
  2. Add one extension. On the desktop app, install from Plugins. For CLI or Skill variants, configure per the project documentation.
  3. Validate in a new session. Have Codex complete one real task. Check both the result and the permissions it requested.

4. Three Common Combinations

Some configurations recur often and make a useful starting point:

  • Cross-file development: Superpowers plus the GitHub integration.
  • Web acceptance: Playwright CLI plus the React skill.
  • New SDK adoption: Context7 plus the upstream official documentation.

The rule behind each combination: choose one access mode for the same capability. After installation, verify in a new conversation that the skill is actually callable.

5. A Ready-to-Use Installation Sequence

Add one extension for the workflow first, then one for external information. For a large feature effort, search for "Superpowers" in the Codex "Plugins" section. When remote GitHub context is needed, install the GitHub plugin and complete authorization. After both are installed, open a new conversation and check that the skill is invoked and the remote tool is visible.

For a web project, add the Playwright CLI separately. The current starting command in the Microsoft repository is:

npm install -g @playwright/cli@latest
playwright-cli --help

After the command runs, ask Codex to execute a concrete page flow and save a screenshot. To install the bundled skill, the official README lists playwright-cli install --skills. Confirm that the current Codex environment recognizes the skill first. For Context7, select one mode from CLI plus Skill or MCP in its official installation flow, to avoid connecting the same documentation source twice.

Then add task-specific capability by project type: React or Next.js projects pick react-best-practices; Expo projects pick Expo Skills; database projects connect Supabase MCP only when needed. For browser acceptance, choose between Playwright CLI, Playwright MCP, and Chrome DevTools MCP by test-versus-diagnosis intent. Security review can add the Trail of Bits plugin on its own. Every addition should answer three questions: which step it solves, what permissions it needs, and whether the result is visible in a real task.

6. Access and Permissions Stay in Scope

The list above is about capability, but the harder constraint is access. Several entries touch credentials: GitHub authorization, Supabase read-only configuration, and production write protection. A team should define, before enabling a new extension, which credentials the agent holds and whether writes are allowed.

The same discipline applies to the APIs the agent calls. Teams that expose internal services to a coding agent often put a gateway in front of them. An API gateway such as Treerouter centralizes authentication, rate limits, and request logs, so every agent call is auditable before it reaches the underlying service. This turns a scattered permission surface into one choke point, which is easier to review and easier to revoke.

This principle is worth restating in operational terms. When an agent gains the ability to act, its calls become part of the audit trail. Enforcing that trail at the edge, rather than inside each service, keeps the blast radius small and makes rollback tractable. For teams running their own model-backed or data-backed APIs, a gateway is the layer where that enforcement lives.

7. Scope Notes and Data Currency

All magnitudes and installation methods in this guide were verified as of October 12, 2026. The basis is OpenAI Docs, the maintainer READMEs of each project, and GitHub repository metadata. Entry points, permissions, and repository states change over time. When they do, the relevant official pages take precedence over this summary.

References

Learn more: https://treerouter.com