The current model
A Skill is the workflow. A plugin is the distribution package.
A Codex Skill is a directory whose required SKILL.md defines a name, description, and instructions. It may also contain scripts, references, assets, and optional metadata.
Codex initially sees each available Skill’s name, description, and path. It loads the full instructions only after the Skill is selected. You can invoke one explicitly with /skills or $; Codex can also match a task to the description implicitly.
The former OpenAI Skills Catalog repository is now deprecated in favor of the Plugins repository. $skill-installer remains documented for local curated Skills and other repositories.
Useful starting points
Match the Skill to the failure mode
The names below are not a universal ranking. They are concrete candidates from current Supercode collections, grouped by the kind of work they are designed to change.
Turn an unclear idea into a buildable brief
Use grill-me when the assumptions need pressure-testing; use to-prd when the thinking is settled and the missing artifact is a structured product brief.
Debug a failure without random edits
A strong fit when the main failure mode is jumping to fixes before reproducing, isolating, and explaining the cause.
Create a new interface from a loose direction
Compare their visual process and output constraints. Pick the one whose design vocabulary matches the product—not the one with the larger install count.
Polish an interface that already works
The first targets interaction and finish; the second targets an explicit accessibility review. They can complement each other because their acceptance criteria differ.
Raise confidence before merging code
Code review searches for defects and design risks; verification-before-completion focuses on proving that claimed work actually passes the required checks.
A planning Skill should not silently become a debugging Skill; a visual-polish Skill should not own architecture decisions. Clear ownership makes explicit invocation predictable and prevents several Skills from competing for the same prompt.
The false shortcut
Popularity tells you what to inspect—not what to trust.
Useful discovery signals
Install history Repository stars Trending velocity Curator selectionActual selection decision
Fits this job Behavior is inspectable Capability is justified Task result improvesCodex’s initial Skills list has a context budget: at most 2% of the model context window, or 8,000 characters when the window is unknown. With a large installed set, Codex can shorten descriptions and omit some Skills from the initial list. More Skills are not an infinite free capability layer.
Keep the portfolio small enough that each Skill has a distinct responsibility. When two descriptions claim the same prompt, explicit invocation becomes necessary and implicit routing becomes harder to predict.
The selection system
Pass six gates before installation
This framework is a practical editorial method—not an OpenAI score, a catalog ranking algorithm, or a security certification.
Defined outcome
Write down the observable result you need: a reviewed migration, a reproducible diagnosis, or an accessible interface.
blocking gatePrecise trigger
The name and description should predict when the Skill activates—and when it should not.
route gateInspectable contents
Read the full SKILL.md, referenced files, scripts, commands, and external destinations.
blocking gateProportional capability
Filesystem writes, shell commands, network access, and credentials must match the job.
blocking gateProvenance + maintenance
Assess the publisher, canonical source, license, revision history, and platform freshness.
evidence gateObservable task proof
Run fixed inputs and acceptance criteria before promoting the Skill beyond a trial.
proof gateA representative repository task
InputSame repository state and prompt
AcceptanceThree to five observable checks
DecisionKeep, revise, scope down, disable, or remove
Apply the framework
Use the catalog as an inspection surface
A useful discovery surface must expose more than a title and an install count. The Supercode Skills Directory brings raw instructions, source, publisher, license, history, adoption, and available audit results into one inspection flow.
Map every catalog field back to a decision. Adoption can prioritize inspection. Raw instructions explain behavior. Source, license, and dates help assess provenance. Audit information contributes another review signal. None independently proves suitability or safety.
Example: compare two interface Skills without guessing from their names
Open frontend-design and design-an-interface side by side. Start with each description: does it identify the same trigger, or does one own early visual direction while the other owns implementation from an existing brief?
Then read the raw SKILL.md. Compare the sequence of steps, files it asks Codex to inspect, commands or references it can load, assumptions about the frontend stack, and the form of the final output. A polished marketplace summary cannot reveal those operational differences.
Finally, give both the same small screen and the same acceptance checks—visual hierarchy, responsive behavior, accessibility, and consistency with the repository’s design system. Keep the one whose process and output fit; the other may still be good, just not for that role.
description · summary · raw SKILL.md
publisher · source · original links
first seen · latest observed · history
license · repository details
audit provider + reported status
all-time installs + recent activity
Reduce the search space
Start with the collection that matches the job
Curated collections group candidates around the work instead of forcing you through an undifferentiated Skills catalog. Use them to build a shortlist, then compare the actual instructions of the individual candidates.
Editors’ Choice
A broad editorial starting set for users who do not yet have a specific category.
Frontend & Design
Visual direction, interaction design, and implementation quality for interface work.
Code Excellence
Review, refactoring, and architectural quality for code that must remain maintainable.
Contain the trial
Install at the narrowest useful scope
Repository / workspace
default trialProject conventions, stack guidance, design systems, deployment procedures, and first evaluations.
User / global
after proofA workflow that has demonstrated value across several unrelated repositories.
Plugin / team distribution
maintained packageReusable public or organizational distribution, especially when connectors are bundled.
Native Codex supports $skill-installer for curated local Skills and repository paths. Supercode supports workspace and global installation from a Skill page, plus an npx skills add command and agent-prompt option.
Invoke the Skill explicitly for the first test. Evaluate implicit triggering only after the workflow itself has earned a place.
The trust boundary
Treat third-party Skills like dependencies
A Skill can influence an agent that already has access to source code, shell commands, network tools, and credentials. It is not “just a prompt” merely because its primary file is Markdown.
Cloud Security Alliance guidance recommends third-party dependency rigor: verify the source, read the complete instructions, inspect unexpected commands and data routes, and use least privilege. Research has also demonstrated malicious natural-language instructions that evade tested signature-oriented defenses.
Do not call a Skill safe or trusted without naming what was checked, by whom, for which revision, and what remains outside the review.
- 01Known source and inspectable revision
- 02Complete instruction and supporting-file review
- 03Proportionate tools, network, and filesystem access
- 04Available audit and curation signals
- 05Narrow installation scope
- 06Observable runtime behavior and a removal path
The final gate
Codex Skills pre-install checklist
- I can state the desired output and its acceptance criteria.
- The trigger does not overlap another installed Skill.
- I read the complete SKILL.md and every relevant supporting file.
- Scripts, commands, tools, network access, and write scope match the job.
- I checked the canonical source, publisher, license, and maintenance signals.
- I treat curation, installs, stars, and audits as signals—not guarantees.
- I chose repository or workspace scope unless broader scope is necessary.
- I defined a fixed prompt and observable acceptance criteria.
- I know how to disable or remove the Skill if it fails.
The best Codex Skill is the one you can explain before it runs and justify after it finishes.
Primary evidence and boundaries
Sources and freshness
OpenAI distribution, invocation, and Skill-loading behavior changes quickly. Mechanics and public collection names were reviewed on September 14, 2026.
The next useful action
Start with one candidate—not an install spree
Choose a candidate for the bottleneck in your workflow. Inspect the complete Skill, install it at narrow scope, and compare the result against explicit acceptance checks.