$ loading_
Install Codex skills from curated lists or GitHub repositories into your local environment.
Overall risk is low to moderate: the skill itself is open-source and from a relatively credible source, primarily used to list and install skills from GitHub. The main considerations are network access, writing into the local skills directory, and the ability to install from arbitrary GitHub repositories, including private ones.
No mandatory secrets are required per the materials, but private GitHub access may use existing git credentials or optional GITHUB_TOKEN/GH_TOKEN. These are sensitive credentials, and misuse during third-party repo installation could broaden access to private code.
The README explicitly states that the scripts use the network, primarily to reach GitHub-related endpoints for curated listings and repository downloads, with fallback to git/SSH. The egress targets are consistent with the stated function, and no unrelated or unknown endpoints are disclosed, but user-specified repo/path requests are still sent to GitHub.
This skill runs local helper scripts and may invoke download, git sparse checkout, and SSH-related system capabilities. That is typical installer behavior, and the materials do not show arbitrary code execution or privilege escalation beyond the stated scope.
It reads `$CODEX_HOME/skills` to annotate installed status and writes skills into `$CODEX_HOME/skills/<skill-name>`, with support for `--dest <path>` to customize the destination. This gives it local file read/write capability, but the materials do not indicate access to unrelated user data.
Positive factors include a GitHub-hosted open-source repository with strong community adoption (~22k stars), which lowers risk. However, the skill can install content from arbitrary GitHub repository paths, including private repos, while the license is unspecified and maintenance status is unknown, so third-party skill sources and installed content still require separate review.
Copy the install command and let the AI configure it · recommended for beginners
Please install the "skill-installer" skill from askskill: 1. Download https://raw.githubusercontent.com/openai/skills/main/skills/.system/skill-installer/SKILL.md 2. Save it as ~/.claude/skills/skill-installer/SKILL.md 3. Reload skills and tell me it's ready
Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.curated, but users can also provide other locations.
Use the helper scripts based on the task:
.curated, but you can pass --path skills/.experimental when they ask about experimental skills.Install skills with the helper scripts.
When listing skills, output approximately as follows, depending on the context of the user's request. If they ask about experimental skills, list from .experimental instead of .curated and label the source accordingly:
"""
Skills from {repo}:
After installing a skill, tell the user it will be available on their next turn.
All of these scripts use network, so when running in the sandbox, request escalation when running them.
scripts/list-skills.py (prints skills list with installed annotations)scripts/list-skills.py --format jsonscripts/list-skills.py --path skills/.experimentalscripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill> ...]scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>scripts/install-skill-from-github.py --repo openai/skills --path skills/.experimental/<skill-name>$CODEX_HOME/skills/<skill-name> (defaults to ~/.codex/skills).--path values install multiple skills in one run, each named from the path basename unless --name is supplied.--ref <ref> (default main), --dest <path>, --method auto|download|git.https://github.com/openai/skills/tree/main/skills/.curated via the GitHub API. If it is unavailable, explain the error and exit.GITHUB_TOKEN/GH_TOKEN for download.$CODEX_HOME/skills.Generate or edit bitmap images for illustrations, photos, textures, mockups, and cutouts.
Build, scaffold, refactor, and troubleshoot ChatGPT Apps SDK applications.
Create a composable CLI from docs, specs, SDKs, apps, or scripts.
Turn vague intentions into concrete, measurable goals and clear success criteria.
Create a new blank Figma design or FigJam file to start collaborating quickly.
Connect to Figma, fetch design assets, and turn nodes into production code.
Create or update skills that extend Codex with knowledge, workflows, and tools.
Import and manage Markdown skills from GitHub for local use.
Create, refine, validate, and restructure AgentSkills and SKILL.md files.
Compile websites, docs, and repos into SKILL.md packages for coding agents.
Turn a repeated workflow into a reusable skill file from the current session.
Create, refine, and evaluate AI skills for better performance and triggering accuracy.