diff --git a/packages/daemon/assets/plugins/openrig/README.md b/packages/daemon/assets/plugins/openrig/README.md
index 48a85810e..314176725 100644
--- a/packages/daemon/assets/plugins/openrig/README.md
+++ b/packages/daemon/assets/plugins/openrig/README.md
@@ -52,10 +52,10 @@ codex plugin add openrig@openrig-app
 codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door
 ```
 
-- **A non-default OpenRig home:** Codex doesn't pass your shell's environment to MCP servers. If your team runs on a
-  non-default OpenRig home, add `--env OPENRIG_HOME=<that home>` to the `codex mcp add` line.
-- **Approvals:** Codex asks you to approve each tool that writes (create, claim, update) the first time it's used. Tools
-  that only read don't ask.
+- **A non-default OpenRig home:** Codex does not forward every shell environment variable to MCP servers by default. If
+  your team runs on a non-default OpenRig home, add `--env OPENRIG_HOME=<that home>` to the `codex mcp add` line.
+- **Approvals:** Codex may ask you to approve tools according to its approval settings. Create, claim and update change
+  team state; tools that only read are marked read-only.
 
 ## What it doesn't do
 
diff --git a/packages/daemon/assets/plugins/openrig/skills/working-with-an-openrig-team/SKILL.md b/packages/daemon/assets/plugins/openrig/skills/working-with-an-openrig-team/SKILL.md
index e980850a4..c05590edb 100644
--- a/packages/daemon/assets/plugins/openrig/skills/working-with-an-openrig-team/SKILL.md
+++ b/packages/daemon/assets/plugins/openrig/skills/working-with-an-openrig-team/SKILL.md
@@ -75,8 +75,8 @@ behave; this skill is the loop around them.
 3. Connect the app to that address, then start a new session so the MCP server starts with it:
    - **Claude Code:** set it as the plugin's OpenRig seat in the plugin's settings.
    - **Codex:** run `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`. Codex
-     doesn't pass the shell's environment to MCP servers, so if the team's OpenRig home isn't the default, add
-     `--env OPENRIG_HOME=<that home>` too.
+     does not forward every shell environment variable to MCP servers by default, so if the team's OpenRig home isn't the
+     default, add `--env OPENRIG_HOME=<that home>` too.
    - **Another app:** add an MCP server that runs `rig mcp serve --front-door` with `OPENRIG_SESSION_NAME` set to the
      address.
 
diff --git a/packages/daemon/specs/agents/shared/skills/core/working-with-an-openrig-team/SKILL.md b/packages/daemon/specs/agents/shared/skills/core/working-with-an-openrig-team/SKILL.md
index e980850a4..c05590edb 100644
--- a/packages/daemon/specs/agents/shared/skills/core/working-with-an-openrig-team/SKILL.md
+++ b/packages/daemon/specs/agents/shared/skills/core/working-with-an-openrig-team/SKILL.md
@@ -75,8 +75,8 @@ behave; this skill is the loop around them.
 3. Connect the app to that address, then start a new session so the MCP server starts with it:
    - **Claude Code:** set it as the plugin's OpenRig seat in the plugin's settings.
    - **Codex:** run `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`. Codex
-     doesn't pass the shell's environment to MCP servers, so if the team's OpenRig home isn't the default, add
-     `--env OPENRIG_HOME=<that home>` too.
+     does not forward every shell environment variable to MCP servers by default, so if the team's OpenRig home isn't the
+     default, add `--env OPENRIG_HOME=<that home>` too.
    - **Another app:** add an MCP server that runs `rig mcp serve --front-door` with `OPENRIG_SESSION_NAME` set to the
      address.
 
diff --git a/scripts/skill-edge-digests.generated.json b/scripts/skill-edge-digests.generated.json
index 9da79336b..e91450155 100644
--- a/scripts/skill-edge-digests.generated.json
+++ b/scripts/skill-edge-digests.generated.json
@@ -2,7 +2,7 @@
   "version": 1,
   "edges": {
     "bundle": {
-      "working-with-an-openrig-team/SKILL.md": "8c9f8aa8da5ebd9aff91c00574627e15f3ef723ee8a6b0fd3c438ebe727e90e2"
+      "working-with-an-openrig-team/SKILL.md": "4b3e6e8eecb710abdb95d604c419599566dbc77b019b49175e936e713b65cf6f"
     },
     "canonical": {
       "core/agent-starters/SKILL.md": "8e8961f44fccb812f39e01174a331dab24f153ceaba91925f1e42371836cdec0",
@@ -27,7 +27,7 @@
       "core/specification-system/SKILL.md": "5226d6e8b1362df89ba3d5afd82e4b4add355870132ca4b140d7f9f4324ffdc1",
       "core/topology-mutation-and-seat-management/SKILL.md": "527ca074432ce6513fb25cd27e8c709dabe0c91361b8999e09b272f3813abe62",
       "core/watchdog/SKILL.md": "24b2e756e3e9d067fa93a4b5fa5f48a5cce511e8b1a5b360b1c39bc09bc95d82",
-      "core/working-with-an-openrig-team/SKILL.md": "8c9f8aa8da5ebd9aff91c00574627e15f3ef723ee8a6b0fd3c438ebe727e90e2",
+      "core/working-with-an-openrig-team/SKILL.md": "4b3e6e8eecb710abdb95d604c419599566dbc77b019b49175e936e713b65cf6f",
       "pm/backlog-capture/SKILL.md": "345c2b47fc85e48c15c0d42bbb48fb27dd3b0ceec36bf59dc6ed20daaea47a84",
       "pm/context-builder/SKILL.md": "0134c9b0a9f196565109f7f51b6ec78d5c3e4b5982a0d7105a93b29952625b3c",
       "pm/exec-summary/SKILL.md": "ada0f42337920e7acdd94e24cad4f5c269b057e750f4a7fc627ea9efbc02fcb6",
@@ -132,7 +132,7 @@
       "core/specification-system/SKILL.md": "5226d6e8b1362df89ba3d5afd82e4b4add355870132ca4b140d7f9f4324ffdc1",
       "core/topology-mutation-and-seat-management/SKILL.md": "527ca074432ce6513fb25cd27e8c709dabe0c91361b8999e09b272f3813abe62",
       "core/watchdog/SKILL.md": "24b2e756e3e9d067fa93a4b5fa5f48a5cce511e8b1a5b360b1c39bc09bc95d82",
-      "core/working-with-an-openrig-team/SKILL.md": "8c9f8aa8da5ebd9aff91c00574627e15f3ef723ee8a6b0fd3c438ebe727e90e2",
+      "core/working-with-an-openrig-team/SKILL.md": "4b3e6e8eecb710abdb95d604c419599566dbc77b019b49175e936e713b65cf6f",
       "pm/backlog-capture/SKILL.md": "345c2b47fc85e48c15c0d42bbb48fb27dd3b0ceec36bf59dc6ed20daaea47a84",
       "pm/context-builder/SKILL.md": "0134c9b0a9f196565109f7f51b6ec78d5c3e4b5982a0d7105a93b29952625b3c",
       "pm/exec-summary/SKILL.md": "ada0f42337920e7acdd94e24cad4f5c269b057e750f4a7fc627ea9efbc02fcb6",
diff --git a/skills/_canonical/core/working-with-an-openrig-team/SKILL.md b/skills/_canonical/core/working-with-an-openrig-team/SKILL.md
index e980850a4..c05590edb 100644
--- a/skills/_canonical/core/working-with-an-openrig-team/SKILL.md
+++ b/skills/_canonical/core/working-with-an-openrig-team/SKILL.md
@@ -75,8 +75,8 @@ behave; this skill is the loop around them.
 3. Connect the app to that address, then start a new session so the MCP server starts with it:
    - **Claude Code:** set it as the plugin's OpenRig seat in the plugin's settings.
    - **Codex:** run `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`. Codex
-     doesn't pass the shell's environment to MCP servers, so if the team's OpenRig home isn't the default, add
-     `--env OPENRIG_HOME=<that home>` too.
+     does not forward every shell environment variable to MCP servers by default, so if the team's OpenRig home isn't the
+     default, add `--env OPENRIG_HOME=<that home>` too.
    - **Another app:** add an MCP server that runs `rig mcp serve --front-door` with `OPENRIG_SESSION_NAME` set to the
      address.