All skills
openai avatar

/skill-installer

@6f65b9a
by openaiopenai/codex127k stars
19,934

Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos).

Use this Skill: https://skilld.dev/gh/openai/codex/skill-installer

This session only. Nothing lands on disk.

SKILL.md

≈61 tokens always: the name and description. ≈752 when used: this file. ≈56 more on demand in 1 file.

Skill Installer

Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.curated, but users can also provide other locations. Experimental skills live in https://github.com/openai/skills/tree/main/skills/.experimental and can be installed the same way.

Use the helper scripts based on the task:

  • List skills when the user asks what is available, or if the user uses this skill without specifying what to do. Default listing is .curated, but you can pass --path skills/.experimental when they ask about experimental skills.
  • Install from the curated list when the user provides a skill name.
  • Install from another repo when the user provides a GitHub repo/path (including private repos).

Install skills with the helper scripts.

Communication

When listing skills, output approximately as follows, depending on the context of the user's request. If they ask about experimental skills, list from .experimental instead of .curated and label the source accordingly: """ Skills from {repo}:

  1. skill-1
  2. skill-2 (already installed)
  3. ... Which ones would you like installed? """

After installing a skill, tell the user it will be available on their next turn.

Scripts

All of these scripts use network, so when running in the sandbox, request escalation when running them.

  • scripts/list-skills.py (prints skills list with installed annotations)
  • scripts/list-skills.py --format json
  • Example (experimental list): scripts/list-skills.py --path skills/.experimental
  • scripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill> ...]
  • scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>
  • Example (experimental skill): scripts/install-skill-from-github.py --repo openai/skills --path skills/.experimental/<skill-name>

Behavior and Options

  • Defaults to direct download for public GitHub repos.
  • If download fails with auth/permission errors, falls back to git sparse checkout.
  • Aborts if the destination skill directory already exists.
  • Installs into $CODEX_HOME/skills/<skill-name> (defaults to ~/.codex/skills).
  • Multiple --path values install multiple skills in one run, each named from the path basename unless --name is supplied.
  • Options: --ref <ref> (default main), --dest <path>, --method auto|download|git.

Notes

  • Curated listing is fetched from https://github.com/openai/skills/tree/main/skills/.curated via the GitHub API. If it is unavailable, explain the error and exit.
  • Private GitHub repos can be accessed via existing git credentials or optional GITHUB_TOKEN/GH_TOKEN for download.
  • Git fallback tries HTTPS first, then SSH.
  • The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no need to help users install those. If they ask, just explain this. If they insist, you can download and overwrite.
  • Installed annotations come from $CODEX_HOME/skills.

Source: SKILL.md on GitHub

2 warnings1mo3 checks · Risk SAFE
  • Gen Agent Trust Hub1mo

    This skill provides functionality for installing and listing skills from GitHub repositories. It includes standard features for interacting with the GitHub API and performing sparse checkouts. The skill contains some security considerations, such as subprocess command execution and network operations, which are used within its intended purpose of repository management. These findings trace back to the vendor's expected infrastructure and tools.

  • Socket1mo

    2 alerts: gptAnomaly

  • Snyk1mo

    Risk: MEDIUM · 2 issues

Signed by skilld at 6f65b9a. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 7 hours ago.

Activeupdated 3 months ago
Other metadata
metadata
{
  "short-description": "Install curated skills from openai/skills or other repos"
}

README badge

README badge for openai/codex/skill-installer