OpenAI Skills Installer
Install Codex skills from curated catalogs or GitHub repositories.
The scripts include relative-path, skill-name, ZIP path-traversal, and destination-exists checks, with temporary-directory cleanup. However, they access GitHub and may use GITHUB_TOKEN/GH_TOKEN or existing Git credentials without defining pre-install confirmation, permission scope, sensitive-data handling, or rollback, so points are deducted.
The main paths, argument validation, HTTP errors, and Git fallback are implemented, and failures are generally diagnosable. However, there are no tests or execution records, and coverage of Git fallback, malformed API responses, symlinks, and network edge cases is limited; static calibration caps this at 10.
The audience and scenarios—listing curated/experimental skills and installing by name or GitHub path—are reasonably clear. Non-fit boundaries, trigger precision, Chinese-language interaction, and mainland-China reachability are not sufficiently documented, and the supplied versions differ on experimental-skill support, so points are deducted.
The documentation is readable and includes scripts, parameters, examples, default locations, and some failure behavior. However, licensing is only referenced in an external directory and is unverified here; versioning, changelog, maintenance ownership, and comprehensive troubleshooting are missing, so points are deducted.
The skill can list skills and copy a selected skill into CODEX_HOME/skills, producing a directly usable core result. Its reliance on network and GitHub access, restart requirement, and lack of static evidence of representative outputs or comparative benefit justify a conservative score.
The source code and documentation provide auditable implementation details for key parameters and paths. There are no committed tests, CI results, or third-party execution records, so the conclusion relies mainly on one static evidence set and remains below 5.
- Installation makes network requests to GitHub and may use access tokens or Git credentials from the environment; before execution, the repository, ref, path, and credential data flow should be shown and confirmed by the user.
- There is no complete transactional rollback or content-integrity verification; recovery after interruption, malicious repository content, or partial failure requires further review.
- The supplied SKILL.md variants differ on experimental-skill support, so the exact pinned revision should be verified before publication.
- License, versioning, maintenance ownership, and CI/test evidence are not provided; official organizational provenance is not evidence of quality or safety.
What does this skill do, and when should you use it?
This skill installs Codex skills into $CODEX_HOME/skills. It defaults to curated skills from openai/skills, while also supporting experimental skills and paths from other GitHub repositories. It can list available skills and install them by name, repository path, or GitHub directory URL. Because it is under .system, the README says it is automatically installed in the latest Codex version.
Lists skills from the .curated or .experimental directories; uses Python helper scripts to download skills from public GitHub repositories; falls back to sparse Git checkout over HTTPS or SSH when download encounters authentication or permission errors; installs each skill under $CODEX_HOME/skills/<skill-name>; and tells the user that an installed skill will be available on the next turn.
- A Codex user wants a current curated-skill list with installed annotations.
- A user knows the name of a curated skill and wants to install it by name.
- A user wants an experimental skill and needs to specify the skills/.experimental path.
- A user needs to install a skill from a public or private GitHub repository path.
- A user wants to install multiple skills in one run using multiple --path arguments.
What are this skill's strengths and limitations?
- Supports curated, experimental, public-repository, and private-repository sources.
- Accepts skill names, repository paths, and GitHub directory URLs.
- Uses direct downloads by default and offers Git fallback handling for authentication failures.
- Can install multiple paths in one run.
- Requires network access to GitHub.
- Private repositories require existing Git credentials or GITHUB_TOKEN/GH_TOKEN.
- Does not overwrite an existing destination skill directory.
- The README provides no test suite, version compatibility matrix, or detailed error-handling documentation.
- It targets Codex's $CODEX_HOME/skills directory, so other clients require adaptation.
How do you install this skill?
This skill is located under skills/.system. The README states that .system skills are automatically installed in the latest Codex version, so no separate installation is required. To fetch another skill from GitHub, use: scripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill>. You can also use: scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>. The script aborts if the destination directory already exists.
How do you use this skill?
List the default curated skills with: scripts/list-skills.py. Request JSON output with: scripts/list-skills.py --format json. List experimental skills with: scripts/list-skills.py --path skills/.experimental. To install a curated skill, provide its name, for example: $skill-installer gh-address-comments. To install from another repository, provide a GitHub repository path or directory URL. Restart Codex after installation so it can discover the new skill.