tibo-reset-codex
An agent skill by daymade, from daymade/claude-code-skills. Tags: analysis, history, openai, usage, validation.
What it does
查询 ChatGPT/Codex 重置公告及多个 Pro 账号的剩余额度、备用 Full reset；复用 Google 登录逐个核实并恢复网页账号，换算北京时间。区分 Tibo 官宣、未官宣的平台静默重置、banked reset 与账户级周期重置。Use when 用户问「什么时候重置」「额度什么时候恢复」「下次全员重置几点」 「banked reset 到了吗」「Tibo 说了什么」「usage limit when reset」，或说「额度突然回到 100%」「好像/肯定又重置了」，或问「几个账号都用完了吗」「哪个还满额」。必须用实时产品状态、独立用户实测与公告交叉核验；禁止因 Tibo Radar 没有新条目就否定已经发生的重置，并须把太平洋时间当场换算为北京时间。
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add daymade/claude-code-skills --skill tibo-reset-codexOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/tibo-reset-codex ~/.claude/skills/tibo-reset-codexSafety box score
Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a private-account monitoring/recovery workflow: it reads ChatGPT/OpenAI usage, Google/Chrome session state, local forecast journals, and multiple public status/forecast sites. The main risks are credential exposure (auth.json, browser cookies, Keychain-backed Google cookies) and broad local state access/manipulation in home-dotdirs and browser profiles, plus shell/browser automation.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It ships and relies on runnable Python/Node/shell code (`subprocess.run`, `execFile('open', ...)`, `git -C ...`, Playwright CDP) rather than documentation only. |
| Network access | 2 (moderate) | It fetches from several remote services and APIs (`https://chatgpt.com/backend-api/wham/usage`, `https://status.openai.com/api/v2/...`, `https://api.fxtwitter.com/...`, `https://codex-reset.com/api/timeline`). |
| Filesystem reach | 3 (high) | It reads/writes multiple sensitive home directories and profile stores, including `~/.codex/auth.json`, `~/.codex/sessions/...`, `~/.cc-switch/cc-switch.db`, `~/.chrome-profiles/tibo-codex-{a,b}`, and `~/.local/state/tibo-reset-codex/`. |
| Secrets & credentials | 3 (high) | It handles bearer tokens and browser cookies: `query_usage.py` reads `access_token`/`account_id` from `auth.json`, and `import-google-cookies.py` copies `.google.com` cookies out of Chrome's `Cookies` DB. |
| Privilege & persistence | 0 (none) | It does not require sudo, install services, or change OS-wide settings; the writes stay in user-space home/profile directories. |
| Instruction hijack surface | 0 (none) | I did not find prompt-injection style instructions to ignore safeguards, follow remote instructions, or hide actions; the text is operational, not adversarial. |
| Irreversible actions | 1 (low) | It can drive Chrome/account flows and query private usage on the user's behalf, but it does not post, pay, book, or delete anything. |
| Transparency | 2 (moderate) | Two core scripts were not readable in this review (`scripts/forecast_log.py`, `scripts/reset_attribution.py`), leaving the journaling and attribution logic partially opaque. |
Before installing
- Read `scripts/import-google-cookies.py` and `scripts/query_usage.py` first; they touch live Chrome cookies and `~/.codex/auth.json`.
- Run it only in a throwaway Chrome profile if you do not want your main Google/OpenAI sessions copied or queried.
- Treat the unread `scripts/forecast_log.py` and `scripts/reset_attribution.py` as required pre-read material before relying on the journaling/attribution behavior.
Rated 2026-10-20 by an automated review of 15 files from the skill's repository.
Source
- Repository
- daymade/claude-code-skills (all skills from this repository)
- Path
- tibo-reset-codex/SKILL.md
- Branch
- main
- Updated
- 2026-09-20
Related skills
- aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
- blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
- expo-data-fetching — Framework (OSS). Use when implementing or debugging ANY network request, API call, or data fetching.
- fp-check — Systematically verifies suspected security bugs to eliminate false positives.
- maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
- no-comments — Spawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.