Skill Download Gatekeeper

A safety gate for installing third-party Codex skills from unclear sources.

What it does

• Inspects websites, Git repositories, archives, local folders, code snippets, and marketplace listings that may contain Codex skills.
• Detects plausible skill entrypoints such as SKILL.md, skill frontmatter, .codex/skills, skills/, marketplace metadata, and install instructions.
• Reads candidate skill metadata before recommending installation.
• Summarizes each candidate in plain language: name, purpose, when Codex would use it, source, and notable risks.
• Blocks installation until the user explicitly confirms which skill to install.

When to use it

Use it when someone sends you an unknown URL, repository, zip file, local folder, or marketplace listing and asks whether it contains a useful Codex skill.

Why it helps

Skill ecosystems are powerful, but unclear install sources can hide broad permissions, executable scripts, secret handling, destructive commands, or ambiguous behavior. This Agent gives Codex a safer default: inspect first, explain clearly, then wait for explicit confirmation.

Example workflow

1. You provide a repository, archive, web page, or local folder.
2. The Agent checks whether it contains installable Codex skills.
3. It summarizes the candidates and calls out visible risks or missing information.
4. You choose whether to install none, one, or selected skills.
5. Only after your explicit confirmation does Codex proceed with installation.

Safety boundary

This is not an antivirus engine and does not guarantee that code is harmless. It is a practical review-and-confirmation workflow that reduces accidental installs and makes risky sources visible before changes are made.