MCPxelMCPxel
Auto-Pilot
Updated a day ago

skill-installer

Oopenai
1.7k
openai/skills/skills/.system/skill-installer
72
Agent Score

💡 Summary

A skill that installs other AI agent skills from a curated list or any GitHub repository into the local skills directory.

🎯 Target Audience

AI Agent End-UsersSkill DevelopersAI TinkerersProduct Managers overseeing agent capabilities

🤖 AI Roast: “It's a package manager that can't update or remove packages, making it the digital equivalent of a hoarder's closet.”

Security AnalysisMedium Risk

The skill executes network calls, downloads, and writes to the filesystem based on user-provided GitHub paths, introducing risks of dependency confusion, malicious code execution from untrusted repos, and secret leakage via token environment variables. Mitigation: Implement a checksum verification or signature check for curated skills before installation.

name: skill-installer description: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). metadata: short-description: Install curated skills from openai/skills or other repos

Skill Installer

Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.curated, but users can also provide other locations. Experimental skills live in https://github.com/openai/skills/tree/main/skills/.experimental and can be installed the same way.

Use the helper scripts based on the task:

  • List skills when the user asks what is available, or if the user uses this skill without specifying what to do. Default listing is .curated, but you can pass --path skills/.experimental when they ask about experimental skills.
  • Install from the curated list when the user provides a skill name.
  • Install from another repo when the user provides a GitHub repo/path (including private repos).

Install skills with the helper scripts.

Communication

When listing skills, output approximately as follows, depending on the context of the user's request. If they ask about experimental skills, list from .experimental instead of .curated and label the source accordingly: """ Skills from {repo}:

  1. skill-1
  2. skill-2 (already installed)
  3. ... Which ones would you like installed? """

After installing a skill, tell the user: "Restart Codex to pick up new skills."

Scripts

All of these scripts use network, so when running in the sandbox, request escalation when running them.

  • scripts/list-skills.py (prints skills list with installed annotations)
  • scripts/list-skills.py --format json
  • Example (experimental list): scripts/list-skills.py --path skills/.experimental
  • scripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill> ...]
  • scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>
  • Example (experimental skill): scripts/install-skill-from-github.py --repo openai/skills --path skills/.experimental/<skill-name>

Behavior and Options

  • Defaults to direct download for public GitHub repos.
  • If download fails with auth/permission errors, falls back to git sparse checkout.
  • Aborts if the destination skill directory already exists.
  • Installs into $CODEX_HOME/skills/<skill-name> (defaults to ~/.codex/skills).
  • Multiple --path values install multiple skills in one run, each named from the path basename unless --name is supplied.
  • Options: --ref <ref> (default main), --dest <path>, --method auto|download|git.

Notes

  • Curated listing is fetched from https://github.com/openai/skills/tree/main/skills/.curated via the GitHub API. If it is unavailable, explain the error and exit.
  • Private GitHub repos can be accessed via existing git credentials or optional GITHUB_TOKEN/GH_TOKEN for download.
  • Git fallback tries HTTPS first, then SSH.
  • The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no need to help users install those. If they ask, just explain this. If they insist, you can download and overwrite.
  • Installed annotations come from $CODEX_HOME/skills.
5-Dim Analysis
Clarity8/10
Novelty4/10
Utility9/10
Completeness8/10
Maintainability7/10
Pros & Cons

Pros

  • Simplifies skill discovery and installation.
  • Supports private repositories with authentication.
  • Can install multiple skills in a single command.

Cons

  • Lacks basic package management features like update or uninstall.
  • Relies heavily on external network and GitHub availability.
  • Potential for namespace conflicts with manual skill naming.

Disclaimer: This content is sourced from GitHub open source projects for display and rating purposes only.

Copyright belongs to the original author openai.