# Install Codex Skills from GitHub

Finding and installing compatible skills manually takes time and risks incorrect placement. This skill lists available packages and installs selected GitHub skills into the configured Codex directory.

## Install

```bash
npx skillstore add openai/skill-installer
```

## Metadata

- Status: approved
- Slug: skill-installer
- Skillstore revision: r2
- Version status: missing
- Tree hash: e1bf688bc206f5a01a506fab89d9dcff024cdb27a6275b250c1f644d2f2d9a1b
- Author: openai
- GitHub username: openai
- License: MIT
- Repository: https://github.com/openai/codex/tree/e38290846c11424567c9c8226f2be8a2886c5929/codex-rs/skills/src/assets/samples/skill-installer
- Ref: bc37f12c64ad89ca965c1e90d44012af0469ec4e
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, env\_access, external\_commands, filesystem
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/skill-installer
- Manifest: https://skillstore.pages.dev/api/skills/skill-installer/manifest

## Capabilities

- Lists skill directories from a configured GitHub repository path.
- Marks listed skills already present under the local Codex skills directory.
- Installs one or multiple skill folders from public or private GitHub repositories.
- Supports direct archive download and sparse Git checkout fallback.
- Validates source paths, destination names, archive members, and required SKILL.md files.
- Preserves existing installations by refusing to overwrite destination directories.

## Use Cases

- Discover curated skills: List the default curated collection and identify packages that are already installed.
- Install a team skill: Install an internal skill from a private GitHub repository using existing credentials or a token.
- Provision multiple skills: Install several skill folders from one repository into a custom destination.

## Prompt Templates

### List curated skills

```
List skills from the default curated collection. Mark which skills are already installed.
```

### Install one curated skill

```
Install the curated skill named [skill name]. Report the installed destination.
```

### Install from a repository

```
Install the skill at [repository path] from [owner/repository]. Use ref [branch, tag, or commit].
```

### Provision pinned skills

```
Install skills at [first path] and [second path] from [owner/repository]. Pin ref [commit], use Git mode, and report destinations.
```

## Limitations

- Supports GitHub repositories only.
- Requires network access and may require a GitHub authentication token.
- Does not assess the trust or safety of installed skill content.
- Does not update or overwrite an existing skill directory.

## Best Practices

- Review the repository and SKILL.md before installing any third-party skill.
- Pin third-party installations to an immutable commit whenever possible.
- Use a least-privileged GitHub token and remove it from the environment afterward.

## Anti Patterns

- Do not install from an unknown repository based only on the skill name.
- Do not use a broad GitHub token when read-only repository access is sufficient.
- Do not bypass an existing destination error without reviewing the installed copy.

## Security Audit

- Audited at: 2026-08-17T05:43:44.27\+00:00
- Summary: The skill intentionally uses GitHub networking, optional tokens, Git subprocesses, and filesystem writes to install skills. Most Markdown, SVG, path-string, and guarded archive findings are false positives. Arbitrary remote skill content is copied into the active skills directory without trust verification, creating a supply-chain risk.

## Stats

- Views: 444
- Downloads: 151
- Favorites: 1
- Popularity score: 0