📦

openai-docs

Name: openai-docs
Author: openai

Ревизия содержимого r1 Высокий риск 🌐 Доступ к сети⚙️ Внешние команды📁 Доступ к файловой системе⚡ Содержит скрипты🔑 Переменные окружения

Find Current OpenAI and Codex Documentation

OpenAI products, models, and APIs change quickly, making remembered guidance unreliable. This skill retrieves current official documentation and provides concise, cited answers.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "openai-docs" from https://skillstore.io/skills/openai-docs.md and its manifest at https://skillstore.io/api/skills/openai-docs/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/openai-docs.md Подписанный manifest GET /api/skills/openai-docs/manifest Подписанный lockfile GET /api/skills/openai-docs/lockfile

Протестировать

Использование «openai-docs». Which OpenAI API should handle a stateful tool-using workflow?

Ожидаемый результат:

Recommendation: use the documented Responses API workflow. The answer explains state handling, tool calls, limitations, and cites the relevant official guide.

Использование «openai-docs». Plan our migration from a named model to a newer target.

Ожидаемый результат:

Target decision based on current official model guidance.
Compatibility changes for requests, tools, reasoning, and state.
Prompt updates only where documented behavior requires them.
Validation checks and citations for each consequential change.

Использование «openai-docs». Why is the OpenAI documentation MCP server unavailable in my local Codex client?

Ожидаемый результат:

A focused diagnostic covering supported setup, enabled state, policy, authorization, refresh requirements, and evidence needed before claiming success.

Аудит безопасности

Высокий риск

v1 • 17.08.2026 Открыть версионный отчет

Most static matches are false positives caused by SVG coordinates, Markdown text, regular-expression calls, or JavaScript template literals. Confirmed behavior includes official network requests, cache writes, environment reads, shell execution, and a curl fallback. Unrestricted sources and cache destinations create SSRF, argument-injection, local-read, and overwrite risks.

Просканировано файлов

2,028

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (3)

Высокий

scripts/fetch-codex-manual.mjs:133-138 scripts/fetch-codex-manual.mjs:509-510

Unvalidated Manual URL Enables SSRF and Curl Option Injection

The manual URL accepts arbitrary targets and reaches curl without an option terminator, enabling internal requests or curl option injection.

The CLI value is appended directly to curl arguments and no scheme, host, or option-prefix validation occurs.

Средний

scripts/resolve-latest-model-info.cjs:14-25 scripts/resolve-latest-model-info.cjs:32-45

Unrestricted Model Source Reads Local Files or Arbitrary URLs

Environment variables and command arguments can select any local path or HTTP URL, bypassing the skill's official-domain boundary.

The resolver explicitly accepts environment and CLI sources, then reads local files or fetches any HTTP endpoint.

Средний

scripts/fetch-codex-manual.mjs:286-296 scripts/fetch-codex-manual.mjs:394-405 scripts/fetch-codex-manual.mjs:511-512

Unrestricted Cache Directory Can Replace Files

A user-selected cache directory receives fixed filenames through rename operations, which can replace existing files in any writable directory.

The override accepts any writable directory and atomically renames fixed cache filenames over existing entries.

Пункты проверки возможностей (37)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

scripts/fetch-codex-manual.mjs:12

Node.js child_process module

import { execFile } from "node:child_process";

The helper imports child_process and invokes curl through execFile as a network fallback.

Средний

scripts/fetch-codex-manual.mjs:47

Proxy environment variable

process.env.HTTP_PROXY ||

The helper reads standard proxy variables and changes its network transport when they are present.

Средний

scripts/fetch-codex-manual.mjs:48

Proxy environment variable

process.env.HTTPS_PROXY ||

The helper reads standard proxy variables and changes its network transport when they are present.

Средний

scripts/fetch-codex-manual.mjs:49

Proxy environment variable

process.env.http_proxy ||

The helper reads standard proxy variables and changes its network transport when they are present.

Средний

scripts/fetch-codex-manual.mjs:50

Proxy environment variable

process.env.https_proxy;

The helper reads standard proxy variables and changes its network transport when they are present.

Средний

scripts/fetch-codex-manual.mjs:279

Temp directory access

pushCandidate(`/private/tmp/${DEFAULT_CACHE_DIR_NAME}`);

The helper selects and writes to an operating-system temporary cache directory.

Средний

scripts/fetch-codex-manual.mjs:280

Temp directory access

pushCandidate(`/tmp/${DEFAULT_CACHE_DIR_NAME}`);

The helper selects and writes to an operating-system temporary cache directory.

Средний

scripts/resolve-latest-model-info:4

Shell command substitution

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

The POSIX wrapper uses command substitution to locate its script directory or Node runtime.

Средний

scripts/resolve-latest-model-info:23

Shell command substitution

PATH_NODE=$(command -v node 2>/dev/null || true)

The POSIX wrapper uses command substitution to locate its script directory or Node runtime.

Средний

scripts/resolve-latest-model-info:1

Unix shell invocation

#!/bin/sh

The executable wrapper invokes a POSIX shell and then runs a compatible Node runtime.

Средний

scripts/resolve-latest-model-info:29

Hidden file access

"$HOME/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node" \

The wrapper checks executable Node binaries under the user's hidden Codex runtime cache.

Средний

scripts/resolve-latest-model-info:30

Hidden file access

"$HOME/.cache/codex-runtimes/codex-primary-runtime/dependencies/bin/node" \

The wrapper checks executable Node binaries under the user's hidden Codex runtime cache.

Средний

scripts/resolve-latest-model-info.cjs:34

Node.js fs operations

return fs.readFile(new URL(source), "utf8");

The resolver reads a local file when its configurable source is not an HTTP URL.

Средний

scripts/resolve-latest-model-info.cjs:38

Node.js fs operations

return fs.readFile(path.resolve(source), "utf8");

The resolver reads a local file when its configurable source is not an HTTP URL.

Низкий

references/mcp-diagnostics.md:12

Hardcoded URL

codex mcp add openaiDeveloperDocs --url https://developers.openai.com/mcp

The source contains an explicit official OpenAI network endpoint.

Низкий

references/mcp-diagnostics.md:19

Hardcoded URL

url = "https://developers.openai.com/mcp"

The source contains an explicit official OpenAI network endpoint.

Низкий

scripts/fetch-codex-manual.mjs:175

Fetch API call

fetch(url, {

The helper performs an HTTP request with the Fetch API.

Низкий

scripts/fetch-codex-manual.mjs:19

Hardcoded URL

const DEFAULT_MANUAL_URL = "https://developers.openai.com/codex/codex-manual.md";

The source contains an explicit official OpenAI network endpoint.

Низкий

scripts/fetch-codex-manual.mjs:47

Environment variable access (dot notation)

process.env.HTTP_PROXY ||

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:48

Environment variable access (dot notation)

process.env.HTTPS_PROXY ||

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:49

Environment variable access (dot notation)

process.env.http_proxy ||

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:50

Environment variable access (dot notation)

process.env.https_proxy;

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:272

Environment variable access (dot notation)

[process.env.TMPDIR, process.env.TEMP, process.env.TMP].forEach((baseDir) => {

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:47

Environment variable object

process.env.HTTP_PROXY ||

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:48

Environment variable object

process.env.HTTPS_PROXY ||

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:49

Environment variable object

process.env.http_proxy ||

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:50

Environment variable object

process.env.https_proxy;

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/fetch-codex-manual.mjs:272

Environment variable object

[process.env.TMPDIR, process.env.TEMP, process.env.TMP].forEach((baseDir) => {

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/resolve-latest-model-info:8

Standard device file access

"$1" -e 'const major = Number(process.versions.node.split(".")[0]); process.exit(major >= 18 ? 0 : 1

The wrapper redirects runtime-probe output to the standard null device.

Низкий

scripts/resolve-latest-model-info:23

Standard device file access

PATH_NODE=$(command -v node 2>/dev/null || true)

The wrapper redirects runtime-probe output to the standard null device.

Низкий

scripts/resolve-latest-model-info.cjs:44

Fetch API call

const response = await fetch(source, {

The helper performs an HTTP request with the Fetch API.

Низкий

scripts/resolve-latest-model-info.cjs:9

Hardcoded URL

"https://developers.openai.com/api/docs/guides/latest-model.md";

The source contains an explicit official OpenAI network endpoint.

Низкий

scripts/resolve-latest-model-info.cjs:10

Hardcoded URL

const DEFAULT_BASE_URL = "https://developers.openai.com";

The source contains an explicit official OpenAI network endpoint.

Низкий

scripts/resolve-latest-model-info.cjs:14

Environment variable access (dot notation)

source: process.env.LATEST_MODEL_URL || DEFAULT_URL,

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/resolve-latest-model-info.cjs:15

Environment variable access (dot notation)

baseUrl: process.env.LATEST_MODEL_BASE_URL || DEFAULT_BASE_URL,

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/resolve-latest-model-info.cjs:14

Environment variable object

source: process.env.LATEST_MODEL_URL || DEFAULT_URL,

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Низкий

scripts/resolve-latest-model-info.cjs:15

Environment variable object

baseUrl: process.env.LATEST_MODEL_BASE_URL || DEFAULT_BASE_URL,

The helper reads the named environment variable to choose a proxy, cache location, or model source.

Факторы риска

🌐 Доступ к сети (14)

assets/openai-small.svg:2 references/mcp-diagnostics.md:12 references/mcp-diagnostics.md:19 references/upgrading-to-gpt-5p6-sol.md:262 scripts/fetch-codex-manual.mjs:175 scripts/fetch-codex-manual.mjs:19 scripts/fetch-codex-manual.mjs:47 scripts/fetch-codex-manual.mjs:48 scripts/fetch-codex-manual.mjs:49 scripts/fetch-codex-manual.mjs:50 scripts/resolve-latest-model-info.cjs:44 scripts/resolve-latest-model-info.cjs:9 scripts/resolve-latest-model-info.cjs:10 SKILL.md:14

⚙️ Внешние команды (35)

📁 Доступ к файловой системе (18)

references/codex-self-knowledge.md:22 references/codex-self-knowledge.md:24 references/codex-self-knowledge.md:25 references/codex-self-knowledge.md:33 scripts/fetch-codex-manual.mjs:79 scripts/fetch-codex-manual.mjs:318 scripts/fetch-codex-manual.mjs:324 scripts/fetch-codex-manual.mjs:279 scripts/fetch-codex-manual.mjs:280 scripts/fetch-codex-manual.mjs:551 scripts/resolve-latest-model-info:29 scripts/resolve-latest-model-info:30 scripts/resolve-latest-model-info:8 scripts/resolve-latest-model-info:23 scripts/resolve-latest-model-info.cjs:34 scripts/resolve-latest-model-info.cjs:38 scripts/resolve-latest-model-info.cjs:37 scripts/resolve-latest-model-info.cjs:104

⚡ Содержит скрипты (2)

scripts/fetch-codex-manual.mjs:79 scripts/fetch-codex-manual.mjs:324

🔑 Переменные окружения (14)

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/openai-docs/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/openai-docs/security.svg)](https://skillstore.io/skills/openai-docs?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/openai-docs?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/openai-docs/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/openai-docs.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

openai. (2026). openai-docs security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/openai-docs/audits/1

Цитата BibTeX

@techreport{openai-openai-docs-2026,
  author = {openai},
  title = {openai-docs security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/openai-docs/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "openai-docs security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/openai-docs/audits/1"
identifiers:
  - type: other
    value: "skillstore:openai-docs:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Verify API Behavior

Confirm endpoints, request fields, SDK behavior, and error handling against current official documentation.

Plan a Model Migration

Compare targets and identify model, prompt, tool, state, compatibility, and testing changes.

Configure Codex

Find current guidance for Codex settings, skills, plugins, MCP, automations, setup, and troubleshooting.

Попробуйте эти промпты

Find an Official Answer

Find current official OpenAI documentation for [topic]. Answer [question] concisely and cite the supporting page.

Compare Two Models

Compare [model A] and [model B] for [workload] using current official documentation. Evaluate quality, latency, cost, modalities, and availability.

Plan a Verified Migration

Plan a migration from [current model] to [target model] for [application]. Identify API, prompting, tool, state, compatibility, and testing changes with citations.

Audit an OpenAI Integration

Audit this OpenAI integration against current official documentation: [system description]. Identify unsupported assumptions, schema mismatches, migration risks, and the smallest verified fixes.

Лучшие практики

Name the exact product, model, API, or Codex feature in the request.
Preserve explicitly requested models and state workload constraints before asking for recommendations.
Use cited official pages for current facts and disclose any bundled fallback.

Избегать

Do not ask for current pricing, availability, or limits without requiring official citations.
Do not treat a search snippet, memory, or bundled snapshot as current documentation.
Do not request configuration changes when only a documentation answer is needed.

Часто задаваемые вопросы

Which sources does this skill use?

It uses official OpenAI developer documentation, platform documentation, ChatGPT Work learning pages, and narrowly selected bundled references.

Can it choose an OpenAI model?

Yes. It compares documented workload fit, quality, latency, cost, modality, and availability while preserving any explicitly requested model.

Can it update my application?

It can guide or implement requested changes after verifying current API and model documentation. API-backed execution may require a separate credential workflow.

Does it know my account limits or access?

No. It states uncertainty when official documentation does not establish account-specific access, quotas, pricing, billing, or rollout status.

What happens when live documentation is unavailable?

It may use a relevant bundled fallback, clearly disclose that choice, and warn that the information may be outdated.

Can it configure the OpenAI documentation MCP server?

Yes, for a supported local Codex client after explicit authorization. It verifies current setup guidance and does not claim success without evidence.