by nickelsec · Codex Skill · ★ 116
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
go install github.com/nickelsec/bough/cmd/bough@latest
git clone https://github.com/nickelsec/boughTaken from the project's README on GitHub.
None of the 42 rules matched — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against 42 published rules built on the SlowMist agent-security taxonomy, refreshed every 8 hours.
The quality score combines nine heuristic checks of the repo and its README: completeness, clarity, specificity, examples, structure, agent readiness, step-by-step content, instruction quality and security notes. It rates how well the project explains itself to an agent, not the code.
| Stars | 116 |
| Forks | 13 |
| Language | Go |
| Category | Codex Skill |
| License | MIT |
| Quality Score | 63/100 |
| Last Updated | 2026-10-02 |
| Created | 2026-09-02 |
| Platforms | aws, claude-code, cli, codex, go |
| Est. Tokens | ~18k |
Reads your Claude Code and OpenAI Codex CLI session history and draws what you actually built. Not how long your streak is. Claude Code's own covers that. This answers a different question: what did you actually build? Run it That is the whole thing. It finds your projects, asks which one, and opens it in your browser. What you get is a diagram of your own work.
These tools work well together with bough for enhanced workflows:
Looking for a bough alternative? If you're comparing bough with other codex skill tools, these 6 projects are the closest alternatives on Agent Skills Hub — ranked by topic overlap, star count, and community traction.
Local-first Windows tray app for monitoring Claude Code and Codex tokens, costs, sessions, and rate limits
55 rigorous skills for Claude Code, Codex, OpenCode 1 and 2, and Pi: code review, security audit, feature deve
Local-first AI knowledge layer. Extract architecture, query from any AI tool via MCP. Private by architecture.
Local-first CLI for coding-agent context handoff. Transfer and resume sessions across Claude Code, Codex, Curs
Resume and hand off Claude Code, Codex & Gemini CLI sessions between agents: one terminal picker for all your
Ultra-fast token & cost tracker for LLM Token Usage (e.g. Claude Code)
Explore other popular codex skill tools:
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy: 42 published rules, covering credential harvesting, data exfiltration, curl | sh installers and more. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: