skill-installer
Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a c…
它会碰到什么
逐条看命中（5 条严重或高危）
- 高
scripts/github_utils.py:12cred-envreadtoken = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN") - 高
scripts/github_utils.py:12cred-envreadtoken = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN") - 高
scripts/install-skill-from-github.py:47cred-envreadreturn os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex")) - 高
scripts/install-skill-from-github.py:116exec-spawnresult = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
- 高
scripts/list-curated-skills.py:35cred-envreadreturn os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))
这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。
技能内容
Skill Installer
Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.curated, but users can also provide other locations.
Use the helper scripts based on the task:
- List curated skills when the user asks what is available, or if the user uses this skill without specifying what to do.
- Install from the curated list when the user provides a skill name.
- Install from another repo when the user provides a GitHub repo/path (including private repos).
Install skills with the helper scripts.
Communication
When listing curated skills, output approximately as follows, depending on the context of the user's request:
"""
Skills from {repo}:
- skill-1
- skill-2 (already installed)
- ...
Which ones would you like installed?
"""
After installing a skill, tell the user: "Restart Codex to pick up new skills."
Scripts
All of these scripts use network, so when running in the sandbox, request escalation when running them.
scripts/list-curated-skills.py(prints curated list with installed annotations)scripts/list-curated-skills.py --format jsonscripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill> ...]scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>
Behavior and Options
- Defaults to direct download for public GitHub repos.
- If download fails with auth/permission errors, falls back to git sparse checkout.
- Aborts if the destination skill directory already exists.
- Installs into
$CODEX_HOME/skills/<skill-name>(defaults to~/.codex/skills). - Multiple
--pathvalues install multiple skills in one run, each named from the path basename unless--nameis supplied. - Options:
--ref <ref>(defaultmain),--dest <path>,--method auto|download|git.
Notes
- Curated listing is fetched from
https://github.com/openai/skills/tree/main/skills/.curatedvia the GitHub API. If it is unavailable, explain the error and exit. - Private GitHub repos can be accessed via existing git credentials or optional
GITHUB_TOKEN/GH_TOKENfor download. - Git fallback tries HTTPS first, then SSH.
- The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no need to help users install those. If they ask, just explain this. If they insist, you can download and overwrite.
- Installed annotations come from
$CODEX_HOME/skills.
想直接用这个技能？
本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。