skill-installer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-installer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.curated, but users can also provide other locations.
Use the helper scripts based on the task:
.curated, but you can pass --path skills/.experimental when they ask about experimental skills.Install skills with the helper scripts.
When listing skills, output approximately as follows, depending on the context of the user's request. If they ask about experimental skills, list from .experimental instead of .curated and label the source accordingly: """ Skills from {repo}:
Which ones would you like installed? """
After installing a skill, tell the user: "Restart Codex to pick up new skills."
All of these scripts use network, so when running in the sandbox, request escalation when running them.
scripts/list-skills.py (prints skills list with installed annotations)scripts/list-skills.py --format jsonscripts/list-skills.py --path skills/.experimentalscripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill> ...]scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>scripts/install-skill-from-github.py --repo openai/skills --path skills/.experimental/<skill-name>$CODEX_HOME/skills/<skill-name> (defaults to ~/.codex/skills).--path values install multiple skills in one run, each named from the path basename unless --name is supplied.--ref <ref> (default main), --dest <path>, --method auto|download|git.https://github.com/openai/skills/tree/main/skills/.curated via the GitHub API. If it is unavailable, explain the error and exit.GITHUB_TOKEN/GH_TOKEN for download.$CODEX_HOME/skills.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.