Beginner-friendly Codex skills starter pack and library curator
SaferSkills independently audited xiaobai-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
小白 Skills is a starter-pack and library-curation workflow for users who do not want to spend hours researching agent skills before getting useful coverage.
It has two jobs:
needs.
overlapping alternatives to backup, and keep restore notes for later.
content/media tools, image workflows, engineering/TDD, diagnosis, planning, review, and handoff.
backup unless the user explicitly wants that framework.
When the user asks for a beginner-friendly one-click setup, install or keep:
imagegenopenai-docsplugin-creatorskill-creatorskill-installerfind-skills from vercel-labs/skillsfrontend-master from mineru98/llm-proxy-skillsbaoyu-skills from JimLiu/baoyu-skillsmattpocock-skills from mattpocock/skillsxiaobai-skillsDefault backup candidates:
gstack from garrytan/gstack: rich YC-style product/engineering workflow.superpowers from obra/superpowers: strict brainstorming, planning, TDD,debugging, verification, and subagent methodology.
These are useful, but they overlap heavily with Matt Pocock's engineering skills and with each other. Keep them in backup until the user asks for that style or the active engineering set underperforms.
Use the bundled script when possible:
powershell -ExecutionPolicy Bypass -File .\scripts\install-xiaobai-skills.ps1The script should:
~\.codex\skills if needed.-Force is passed.~\.codex\skills-backup\xiaobai-YYYY-MM-DD\ when they are present globally.
SKILLS-GLOBAL-INVENTORY.md.If the script cannot be used, perform the same steps manually with PowerShell or GitHub CLI. Prefer GitHub release/archive downloads when git is missing.
Scan active roots:
Get-ChildItem -LiteralPath "$env:USERPROFILE\.codex\skills" -Force
Get-ChildItem -LiteralPath "$env:USERPROFILE\.codex\skills" -Recurse -Filter SKILL.md -File
Get-ChildItem -LiteralPath "$env:USERPROFILE\.agents\skills" -Force -ErrorAction SilentlyContinueAlso inspect junction/symlink targets directly when recursion does not follow them.
For each SKILL.md, capture:
broad workflow-owning
Use this coverage map:
Tie-breakers:
--yolo, danger, broad shellautomation, or unknown external CLIs.
specific.
Recommended default choice:
backed up.
Never delete by default. Move to:
~\.codex\skills-backup\xiaobai-YYYY-MM-DD\
Suggested structure:
xiaobai-YYYY-MM-DD/
README.md
packages/
disabled-global-entries/
disabled-subskills/Before moving:
Write:
Use SKILLS-GLOBAL-INVENTORY.md in the workspace and copy it into the backup folder as README.md.
When the active choice performs poorly:
Do not re-enable all backup frameworks at once.
When acting as the skill creator, optimize for:
When acting as the skill reviewer, challenge:
This skill's recommended starter set was shaped around these upstream projects:
imagegen, openai-docs, plugin-creator,skill-creator, skill-installer
vercel-labs/skills for find-skillsmineru98/llm-proxy-skills for frontend-masterJimLiu/baoyu-skillsmattpocock/skillsgarrytan/gstackobra/superpowersRespect each upstream project's license and README before redistribution.
End with:
Active:
- <skill/package>: <role>
Backed up:
- <skill/package>: <reason>
Inventory:
- <path>
Next:
- Restart Codex.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.