# Can a Plugin Call Other Plugins in OpenAI Codex? A Complete Guide to Cross-Plugin Invocation

> Discover how OpenAI Codex plugins can call other plugins using the Skill tool. This guide explains cross-plugin invocation and subprocess execution for enhanced functionality.

- Repository: [OpenAI/plugins](https://github.com/openai/plugins)
- Tags: how-to-guide
- Published: 2026-06-15

---

**Yes, a plugin can call other plugins in the OpenAI Codex ecosystem by using the `Skill` tool to load the target plugin's manifest and execute its skills as an isolated subprocess.**

The openai/plugins repository demonstrates a composable architecture where plugins are not isolated silos. A plugin can invoke the capabilities of another plugin directly through the runtime's orchestration layer, enabling powerful workflows without code duplication.

## How Cross-Plugin Invocation Works

### The Skill Tool and Manifest Resolution

When a plugin initiates a call to another plugin, the orchestrator first locates the target plugin's manifest at `plugins/**/.codex-plugin/plugin.json`. This JSON file defines the skill's entry point, required inputs, and policy configurations. The orchestrator streams the called skill's source code into the agent's sandbox and executes it as a subprocess, making the callee's full functionality available to the caller.

### Execution Flow and Sandbox Isolation

Each invoked skill operates within its own isolated environment with dedicated file system access and environment variables. According to the source code in [`plugins/wix/skills/wix-headless/references/SETUP.md`](https://github.com/openai/plugins/blob/main/plugins/wix/skills/wix-headless/references/SETUP.md), the caller cannot escape the callee's sandbox unless it explicitly reads files from the callee's directory. This ensures that cross-plugin calls maintain strict resource boundaries while still allowing data exchange through JSON payloads.

## Invoking Plugins Explicitly

The Codex runtime exposes two primary syntaxes for cross-plugin invocation. The explicit Python API uses `Skill(name="target-plugin")`, while the slash-command syntax uses `$skill-name` as a shortcut.

Policy controls defined in [`plugins/zoom/README.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/README.md) specify that even if a target skill sets `policy.allow_implicit_invocation: false`, explicit invocation by a caller plugin remains permitted. This allows plugin authors to restrict automatic agent usage while enabling intentional programmatic calls.

## Practical Code Examples

### Calling a Calendar Plugin

```python

# Inside plugins/my-assistant/skills/schedule_meeting/main.py

from codex import Skill

def create_meeting(title, start, end):
    # Explicitly invoke the google-calendar plugin

    result = Skill(name="google-calendar").run(
        skill="create_event",
        args={"title": title, "start": start, "end": end}
    )
    return result["event_id"]

```

### Chaining Multiple Plugins

```python

# Inside plugins/report-generator/skills/gen_report/main.py

from codex import Skill

def generate_report(data):
    # First call a data-processing plugin

    processed = Skill(name="data-cleaner").run(
        skill="clean",
        args={"raw": data}
    )["cleaned"]

    # Then call a PDF-export plugin

    pdf = Skill(name="pdf-exporter").run(
        skill="export",
        args={"content": processed}
    )["pdf_path"]

    return pdf

```

## Data Flow and Resource Isolation

Cross-plugin communication follows a strict JSON contract defined in [`plugins/plugin-eval/references/evaluation-result-schema.md`](https://github.com/openai/plugins/blob/main/plugins/plugin-eval/references/evaluation-result-schema.md). Input arguments pass as JSON objects, and the callee returns a JSON result that the caller can forward to users or feed into subsequent skill invocations.

The architecture enforces isolation at the process level. As documented in [`plugins/wix/skills/wix-headless/references/SETUP.md`](https://github.com/openai/plugins/blob/main/plugins/wix/skills/wix-headless/references/SETUP.md), skills should be invoked once to load their assets into the sandbox context, then reused rather than re-invoked repeatedly.

## Summary

- **Cross-plugin invocation is fully supported** in the OpenAI Codex ecosystem through the `Skill` tool.
- **Manifest resolution** occurs via `plugins/**/.codex-plugin/plugin.json` files that define entry points and policies.
- **Explicit invocation** bypasses `policy.allow_implicit_invocation` restrictions, allowing controlled interoperability.
- **JSON contracts** govern data exchange between plugins, with full isolation maintained via subprocess sandboxing.

## Frequently Asked Questions

### Can a plugin call multiple other plugins in sequence?

Yes. A plugin can chain multiple `Skill` invocations, using the output from one plugin as the input to another. The runtime treats each invocation as an independent subprocess, allowing you to build complex workflows across the entire plugin ecosystem.

### What happens if the called plugin has allow_implicit_invocation set to false?

The `policy.allow_implicit_invocation` flag only prevents automatic or implicit invocation by the agent. When a plugin explicitly calls another plugin using `Skill(name="...")` or the `$skill-name` syntax, the orchestrator executes the call regardless of this policy setting, as documented in [`plugins/zoom/README.md`](https://github.com/openai/plugins/blob/main/plugins/zoom/README.md).

### How is data passed between plugins?

Data flows through a JSON contract. The caller passes arguments as a JSON object via the `args` parameter, and the callee returns a JSON result. This schema is standardized according to [`plugins/plugin-eval/references/evaluation-result-schema.md`](https://github.com/openai/plugins/blob/main/plugins/plugin-eval/references/evaluation-result-schema.md), ensuring type-safe communication between isolated sandboxes.

### Does calling another plugin create security risks?

Each plugin invocation runs in its own sandbox with isolated file systems and environment variables. The caller cannot access the callee's internal state unless explicitly granted file system access. This architecture ensures that calling external plugins does not compromise the caller's security boundaries.