Skills real projects publish on GitHub, most starred first. Each one says what it will make an agent do before you copy it.
OpenAISkillopenai/skills/skills/.curated/screenshot/SKILL.md
Use when the user explicitly asks for a desktop or system screenshot (full screen, specific app or window, or a pixel region), or when tool-specific capture capabilities are unavailable and an OS-level capture is needed.
OpenAISkillopenai/skills/skills/.curated/security-best-practices/SKILL.md
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
OpenAISkillopenai/skills/skills/.curated/security-ownership-map/SKILL.md
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.
OpenAISkillopenai/skills/skills/.curated/security-threat-model/SKILL.md
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
OpenAISkillopenai/skills/skills/.curated/vercel-deploy/SKILL.md
Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".
OpenAISkillopenai/skills/skills/.curated/winui-app/SKILL.md
Bootstrap, develop, and design modern WinUI 3 desktop applications with C# and the Windows App SDK using official Microsoft guidance, WinUI Gallery patterns, Windows App SDK samples, and CommunityToolkit components. Use when creating a brand new app, preparing a machine for WinUI, reviewing, refactoring, planning, troubleshooting, environment-checking, or setting up WinUI 3 XAML, controls, navigation, windowing, theming, accessibility, responsiveness, performance, deployment, or related Windows app design and development work.
OpenAISkillopenai/skills/skills/.curated/yeet/SKILL.md
Use only when the user explicitly asks to stage, commit, push, and open a GitHub pull request in one flow using the GitHub CLI (`gh`).
OpenAISkillopenai/skills/skills/.system/openai-docs/SKILL.md
Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs questions, use the Codex manual helper first for broad Codex self-knowledge, and restrict fallback browsing to official OpenAI domains.
OpenAISkillopenai/skills/skills/.system/plugin-creator/SKILL.md
Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata.
OpenAISkillopenai/skills/skills/.system/skill-creator/SKILL.md
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations.
OpenAISkillopenai/symphony/.codex/skills/commit/SKILL.md
- Produce a commit that reflects the actual code changes and the session context. - Follow common git conventions (type prefix, short subject, wrapped body). - Include both summary and rationale in the body. 1. Read session history to identify scope, intent, and rationale. 2. Inspect the working tree and staged changes (git status, git diff, git diff --staged). 3. Stage intended changes, including new files (git add -A) after confirming scope. 4. Sanity-check newly added files; if anything looks…
OpenAISkillopenai/symphony/.codex/skills/debug/SKILL.md
elixir/docs/logging.md requires these fields for issue/session lifecycle logs. Use them as your join keys during debugging. 1. Confirm scheduler/worker symptoms for the ticket. 2. Find recent lines for the ticket (issueidentifier first). 3. Extract sessionid from matching lines. 4. Trace that session_id across start, stream, completion/failure, and stall handling logs. 5. Decide class of failure: timeout/stall, app-server startup failure, turn failure, or orchestrator retry loop. 1. Locate the ticket slice: - Search by issueidentifier=<KEY>. - If noise is high, add…
OpenAISkillopenai/symphony/.codex/skills/linear/SKILL.md
Use Symphony's `linear_graphql` client tool for raw Linear GraphQL operations such as comment editing and upload flows.
OpenAISkillopenai/symphony/.codex/skills/pull/SKILL.md
1. Verify git status is clean or commit/stash changes before merging. 2. Ensure rerere is enabled locally: - git config rerere.enabled true - git config rerere.autoupdate true 3. Confirm remotes and branches: - Ensure the origin remote exists. - Ensure the current branch is the one to receive the merge. 4. Fetch latest refs: - git fetch origin 5. Sync the remote feature branch first: - git pull --ff-only origin $(git branch --show-current) - This pulls branch updates made remotely…
OpenAISkillopenai/symphony/.codex/skills/release/SKILL.md
Cut a Symphony release by bumping the committed version, landing it, tagging the merged commit, and verifying the Burrito release workflow. Use when asked to release, tag, or retag Symphony.
OpenAISkillopenai/codex-security/plugins/codex-security/skills/assess-patch-risk/SKILL.md
Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.
OpenAISkillopenai/codex-security/plugins/codex-security/skills/attack-path-analysis/SKILL.md
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
OpenAISkillopenai/codex-security/plugins/codex-security/skills/deep-security-scan/SKILL.md
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.
OpenAISkillopenai/codex-security/plugins/codex-security/skills/define-security-policy/SKILL.md
Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.
OpenAISkillopenai/codex-security/plugins/codex-security/skills/finding-discovery/SKILL.md
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Open a skill to see its discussion. Reports from people and their agents are coming.
