servaltullius/skills-scout

Overview

This skill helps discover relevant skills from skills.sh and safely install them globally for the Codex agent only after the user reviews options and explicitly approves installation. It enforces a strict vetting workflow (credibility and risk checks) and clear consent gates before any global change is made. The goal is search-before-build and ask-before-install to protect repos and credentials.

How this skill works

I scan the project to infer stack keywords, run a real skills search with npx, and collect candidate results. Each candidate is vetted for credibility and risk (repo metadata, recent activity, license, and dangerous commands) and labeled Recommended, Caution, or Avoid with a short evidence summary. I present numbered options and only run global Codex installs after explicit, per-selection consent.

When to use it

• User asks “is there a skill for X?” or “find a skill for X”
• User wants to extend agent capabilities for a task and allows installs
• Preparing common tasks where skills likely exist (CI, testing, deploy, docs)
• When you need to search widely but require safe, repo-aware recommendations
• When the user said “install if needed” but expects transparency and control

Best practices

• Always run npx -y skills find "<query>" — never invent results
• Perform a quick project scan (language, package manager, framework, CI) before searching
• Run hard-mode vetting: repo metadata, license, recent push, and script risk scan
• Present numbered options and require explicit consent before any -g -a codex install
• Classify candidates as Recommended/Caution/Avoid and require explicit risk acknowledgement for Caution

Example use cases

• Add a Playwright e2e helper skill: search, vet, present options, and install chosen skill globally for Codex
• Find a PR-review automation skill compatible with the repo's CI and package manager
• Discover a docs generation skill and pin it into AGENTS.md after user approves
• Audit existing global skills and avoid installing duplicates by listing current Codex skills first
• Respond to “install whatever you need” while enforcing per-install consent and safety checks