Auto skill safety external skill intake

Skill Arnie016/codex-prompt-templates/skills/auto-skill-safety-external-skill-intake

Color-coded Codex prompt templates and Agent Skills for plugin-orchestrated AI coding workflows, MCP safety, repo intelligence, and automation.

Install

npx -y skills add Arnie016/codex-prompt-templates --skill auto-skill-safety-external-skill-intake

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Safely inspect and adapt third-party agent/Codex/Claude skill packs before installation. Use when importing external skills, prompt packs, slash commands, Skill Forge candidates, OpenDesign-style catalog stubs, or repos with SKILL.md files, commands, hooks, or installers. Triggers: import skills, install skill pack, evaluate third-party skill, prompt-pack safety, adapt Claude skill to Codex. Skip when authoring a new first-party skill from scratch; use `$skill-pack-factory` and `$automation-skill-forge`.

SKILL.md

3.8 KB, as published. Nobody here has run it

External Skill Intake Gate

Generated by: Codex Supercharge maintenance automation.

Goal: convert useful external skill ideas into safe Codex artifacts without running untrusted installers or widening local tool access by accident.

Workflow

Source intake: record repo/path, HEAD or date, license file, disk size, runtime, and whether any code was executed. Start from README, manifests, install scripts, hooks, and SKILL.md files.
Inventory skill surface: list candidate skills, commands, hooks, side-file folders, scripts, external APIs, credentials, and write targets.
Classify risk:
- prompt-only: instructions and references only
- side-files: assets, examples, references, schemas, or templates
- commands: shell, package, browser, network, or filesystem actions
- hooks: conversation capture, prompt injection, or automatic lifecycle
- installer: writes into ~/.codex, ~/.claude, PATH, services, or deps
Gate execution: do not run installers, hooks, package scripts, MCP servers, binaries, or generated commands until reviewed. Use $mcp-safety-review for broad tool/runtime exposure and $auto-skill-safety-mcp-secret-guard for configs or examples with secrets.
Adapt, do not blindly copy: prefer distilled workflow text over full upstream bundles unless license, provenance, side files, and triggers are clear. Preserve source, license, date reviewed, and "code executed: no".
Validate: run $skill-quality-gate on any new or changed skill before installing it.

Commands

du -sh sources/<repo>
bash plugins/codex-supercharge/scripts/repo_snapshot.sh sources/<repo>
find sources/<repo> -path '*/SKILL.md' -o -path '*/commands/*' -o -path '*/hooks/*'
rg -n "install|hooks|commands|allowed-tools|api[_-]?key|token|secret|postinstall|curl|delete|destructive|browser|oauth|shell" sources/<repo>
python3 "$HOME/.codex/skills/.system/skill-creator/scripts/quick_validate.py" plugins/codex-supercharge/skills/<skill-name>
plugins/codex-supercharge/scripts/skill_audit.sh plugins/codex-supercharge/skills

Output

# External Skill Intake Report
Verdict: accept | adapt | reference-only | reject
Source:
License:
Code executed:
Skill inventory:
Risk classification:
Install/write targets:
Secret or account surface:
Adaptation plan:
Validation:

Skip When

The skill is already installed and only needs metadata/quality review; use $skill-quality-gate.
The task is to create original first-party skills from local requirements; use $skill-pack-factory or $automation-skill-forge.
The source is an MCP server or tool runtime rather than a skill/prompt pack; use $mcp-safety-review.

References

plugins/codex-supercharge/references/external-skill-intake.md
plugins/codex-supercharge/references/automation-skill-patterns.md
plugins/codex-supercharge/references/skill-patterns.md

Validation

Every imported skill has provenance, license/trust notes, trigger/skip boundaries, and an explicit execution decision.
Hook, installer, credential, browser, shell, and account-control surfaces are classified before installation.
New or changed skills pass quick_validate.py and skill_audit.sh.