Codex Skill Installer
Install curated or repository-hosted Codex skills without manually assembling their files and paths.
The scripts constrain sources to GitHub, validate relative paths and ZIP traversal, refuse to overwrite existing destinations, and clean temporary directories. However, they install arbitrary repository content, use the mutable default ref main, access the network and optional GitHub credentials, and do not specify user confirmation, complete data-flow disclosure, or rollback, so points are deducted.
Argument parsing, download fallback, path validation, and error reporting are reasonably coherent in static source. No skill-specific tests or execution evidence are provided, and Git/SSH, platform differences, and abnormal-response coverage are limited; the static ceiling and these gaps reduce the score.
Invocation scenarios, repository paths, experimental listings, installation options, and output formats are clearly described. However, support is GitHub-only, non-fit boundaries are incomplete, and Chinese interaction or mainland-China reachability is not addressed; core operation depends on GitHub/API availability, so points are deducted.
The SKILL.md provides layered guidance, a script inventory, parameters, examples, and some limitation notes. The repository supplies Apache-2.0 licensing, official provenance, and security-policy context, but the skill lacks independent versioning, a changelog, explicit maintenance ownership, and a defined update path, so points are deducted.
The scripts cover listing skills, installing one or multiple skills, public or private repositories, download mode, and Git fallback, with outputs intended for direct use. Static review cannot verify successful installation, compatibility, or comparative benefit over manual installation, and results depend on external services, so the score is conservative.
The source and parameter behavior are auditable, with some traceable error paths. There is no skill-specific test suite, CI coverage, or third-party execution evidence, so key paths cannot be independently reproduced from the supplied files and points are deducted.
- Confirm the repository, revision, and target paths before installing arbitrary GitHub content; the default main ref provides no content-integrity guarantee.
- GITHUB_TOKEN or GH_TOKEN is sent with GitHub requests; avoid using credentials in untrusted environments and remember that private-repository content may be copied locally.
- Core operation depends on GitHub, the GitHub API, codeload, and possibly SSH connectivity; mainland-China network restrictions may prevent listing or installation.
- No dedicated tests or rollback command are supplied; back up the destination and verify the installed result independently.
What it does & when to use it
This Agent Skill installs Codex skills from curated or experimental collections and from GitHub repositories. It can list available skills, select installation sources, and place skills under $CODEX_HOME/skills. The workflow uses helper scripts, network access, and local filesystem operations. It is a good fit for developers who regularly extend Codex with external skills.
Lists curated or experimental skills when requested; installs named skills from openai/skills; installs skills from GitHub repository paths or URLs, including private repositories; supports branches, custom destinations, download or Git methods, and multiple paths; aborts when a destination skill directory already exists; and can fall back from direct download to sparse Git checkout after authentication or permission failures.
- A Codex user wants to inspect the current curated skill catalog before choosing an installation.
- A developer knows a curated skill name and wants to install it with the provided helper script.
- A team needs to add a skill from an internal or third-party GitHub repository.
- An early adopter wants to install an experimental skill from the experimental collection.
- A maintainer needs to install several skills together or control the branch, destination, or installation method.
Pros & cons
- Supports curated, experimental, public-repository, and private-repository sources.
- Accepts GitHub URLs and paths, branches, custom destinations, and multiple skill paths.
- Provides a sparse-checkout fallback when direct download encounters authentication or permission problems.
- Avoids overwriting an existing destination skill directory.
- Requires shell execution, network access, and local filesystem permissions.
- Private repository access depends on existing Git credentials or GITHUB_TOKEN/GH_TOKEN.
- The source provides no test results, platform support matrix, or detailed troubleshooting guide.
- Its default $CODEX_HOME/skills packaging is Codex-oriented and may require path or workflow changes in other clients.
How to install
Place this skill directory at $CODEX_HOME/skills/skill-installer; the default equivalent is ~/.codex/skills/skill-installer. The source does not document a complete self-install command, but it documents the command pattern for installing other skills: scripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill>.
How to use
Ask Codex to list available skills, such as “List the installable curated skills.” Provide a curated skill name to install it, or provide a GitHub repository/path to install from another repository. For experimental skills, use the skills/.experimental path. After installation, the skill becomes available on the next turn.