Can a Plugin Call Other Plugins in OpenAI Codex? A Complete Guide to Cross-Plugin Invocation

Yes, a plugin can call other plugins in the OpenAI Codex ecosystem by using the Skill tool to load the target plugin's manifest and execute its skills as an isolated subprocess.

The openai/plugins repository demonstrates a composable architecture where plugins are not isolated silos. A plugin can invoke the capabilities of another plugin directly through the runtime's orchestration layer, enabling powerful workflows without code duplication.

How Cross-Plugin Invocation Works

The Skill Tool and Manifest Resolution

When a plugin initiates a call to another plugin, the orchestrator first locates the target plugin's manifest at plugins/**/.codex-plugin/plugin.json. This JSON file defines the skill's entry point, required inputs, and policy configurations. The orchestrator streams the called skill's source code into the agent's sandbox and executes it as a subprocess, making the callee's full functionality available to the caller.

Execution Flow and Sandbox Isolation

Each invoked skill operates within its own isolated environment with dedicated file system access and environment variables. According to the source code in plugins/wix/skills/wix-headless/references/SETUP.md, the caller cannot escape the callee's sandbox unless it explicitly reads files from the callee's directory. This ensures that cross-plugin calls maintain strict resource boundaries while still allowing data exchange through JSON payloads.

Invoking Plugins Explicitly

The Codex runtime exposes two primary syntaxes for cross-plugin invocation. The explicit Python API uses Skill(name="target-plugin"), while the slash-command syntax uses $skill-name as a shortcut.

Policy controls defined in plugins/zoom/README.md specify that even if a target skill sets policy.allow_implicit_invocation: false, explicit invocation by a caller plugin remains permitted. This allows plugin authors to restrict automatic agent usage while enabling intentional programmatic calls.

Practical Code Examples

Calling a Calendar Plugin

# Inside plugins/my-assistant/skills/schedule_meeting/main.py

from codex import Skill

def create_meeting(title, start, end):
    # Explicitly invoke the google-calendar plugin

    result = Skill(name="google-calendar").run(
        skill="create_event",
        args={"title": title, "start": start, "end": end}
    )
    return result["event_id"]

Chaining Multiple Plugins

# Inside plugins/report-generator/skills/gen_report/main.py

from codex import Skill

def generate_report(data):
    # First call a data-processing plugin

    processed = Skill(name="data-cleaner").run(
        skill="clean",
        args={"raw": data}
    )["cleaned"]

    # Then call a PDF-export plugin

    pdf = Skill(name="pdf-exporter").run(
        skill="export",
        args={"content": processed}
    )["pdf_path"]

    return pdf

Data Flow and Resource Isolation

Cross-plugin communication follows a strict JSON contract defined in plugins/plugin-eval/references/evaluation-result-schema.md. Input arguments pass as JSON objects, and the callee returns a JSON result that the caller can forward to users or feed into subsequent skill invocations.

The architecture enforces isolation at the process level. As documented in plugins/wix/skills/wix-headless/references/SETUP.md, skills should be invoked once to load their assets into the sandbox context, then reused rather than re-invoked repeatedly.

Summary

• Cross-plugin invocation is fully supported in the OpenAI Codex ecosystem through the Skill tool.
• Manifest resolution occurs via plugins/**/.codex-plugin/plugin.json files that define entry points and policies.
• Explicit invocation bypasses policy.allow_implicit_invocation restrictions, allowing controlled interoperability.
• JSON contracts govern data exchange between plugins, with full isolation maintained via subprocess sandboxing.

Frequently Asked Questions

Can a plugin call multiple other plugins in sequence?

Yes. A plugin can chain multiple Skill invocations, using the output from one plugin as the input to another. The runtime treats each invocation as an independent subprocess, allowing you to build complex workflows across the entire plugin ecosystem.

What happens if the called plugin has allow_implicit_invocation set to false?

The policy.allow_implicit_invocation flag only prevents automatic or implicit invocation by the agent. When a plugin explicitly calls another plugin using Skill(name="...") or the $skill-name syntax, the orchestrator executes the call regardless of this policy setting, as documented in plugins/zoom/README.md.

How is data passed between plugins?

Data flows through a JSON contract. The caller passes arguments as a JSON object via the args parameter, and the callee returns a JSON result. This schema is standardized according to plugins/plugin-eval/references/evaluation-result-schema.md, ensuring type-safe communication between isolated sandboxes.

Does calling another plugin create security risks?

Each plugin invocation runs in its own sandbox with isolated file systems and environment variables. The caller cannot access the callee's internal state unless explicitly granted file system access. This architecture ensures that calling external plugins does not compromise the caller's security boundaries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}