跳到主要内容
知仓学习社ZHICANG

skill-installer

Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a c…

读凭据执行命令联网写文件严重 0 · 高危 5foryourhealth111-pixel/Vibe-Skills

它会碰到什么

扫了多少6 个文本文件,28 KB
它会碰到什么读凭据执行命令联网写文件
命中总数11 处
命中统计严重 0 · 高 5 · 中 5 · 低 1
逐条看命中(5 条严重或高危)
  • scripts/github_utils.py:12cred-envread
    token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
  • scripts/github_utils.py:12cred-envread
    token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
  • scripts/install-skill-from-github.py:46cred-envread
    return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))
  • scripts/install-skill-from-github.py:100exec-spawn
    result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
  • scripts/list-skills.py:35cred-envread
    return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Skill Installer

Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.curated, but users can also provide other locations. Experimental skills live in https://github.com/openai/skills/tree/main/skills/.experimental and can be installed the same way.

Use the helper scripts based on the task:

  • List skills when the user asks what is available, or if the user uses this skill without specifying what to do. Default listing is .curated, but you can pass --path skills/.experimental when they ask about experimental skills.
  • Install from the curated list when the user provides a skill name.
  • Install from another repo when the user provides a GitHub repo/path (including private repos).

Install skills with the helper scripts.

Communication

When listing skills, output approximately as follows, depending on the context of the user's request. If they ask about experimental skills, list from .experimental instead of .curated and label the source accordingly:

"""

Skills from {repo}:

  1. skill-1
  2. skill-2 (already installed)
  3. ...

Which ones would you like installed?

"""

After installing a skill, tell the user: "Restart Codex to pick up new skills."

Scripts

All of these scripts use network, so when running in the sandbox, request escalation when running them.

  • scripts/list-skills.py (prints skills list with installed annotations)
  • scripts/list-skills.py --format json
  • Example (experimental list): scripts/list-skills.py --path skills/.experimental
  • scripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill> ...]
  • scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>
  • Example (experimental skill): scripts/install-skill-from-github.py --repo openai/skills --path skills/.experimental/<skill-name>

Behavior and Options

  • Defaults to direct download for public GitHub repos.
  • If download fails with auth/permission errors, falls back to git sparse checkout.
  • Aborts if the destination skill directory already exists.
  • Installs into $CODEX_HOME/skills/<skill-name> (defaults to ~/.codex/skills).
  • Multiple --path values install multiple skills in one run, each named from the path basename unless --name is supplied.
  • Options: --ref <ref> (default main), --dest <path>, --method auto|download|git.

Notes

  • Curated listing is fetched from https://github.com/openai/skills/tree/main/skills/.curated via the GitHub API. If it is unavailable, explain the error and exit.
  • Private GitHub repos can be accessed via existing git credentials or optional GITHUB_TOKEN/GH_TOKEN for download.
  • Git fallback tries HTTPS first, then SSH.
  • The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no need to help users install those. If they ask, just explain this. If they insist, you can download and overwrite.
  • Installed annotations come from $CODEX_HOME/skills.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 3,314
本站分层T1
该仓技能数258
原文件路径bundled/skills/.system/skill-installer/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 258 个技能