OpenAI Skills
OpenAI Skills security: copying a folder is not authorizing its workflow
Review credential use, archive boundaries, untrusted logs, destination collisions and the difference between declared workflow rules and enforced tool permissions.
What you will learn
- Review before activation
- Know which credentials and evidence are involved
- Operate with explicit rollback and scope
Before you start
- Basic Git, Python and command-line concepts
- An explicit boundary for permitted repository inspection and changes
Explain the chapter’s source behavior and apply its acceptance checklist without confusing a catalog with its host.
Key takeaways
- Keep installation, activation and external actions as separate authority boundaries.
- Do not confuse archive containment or metadata checks with capability review.
- Preserve revisions and inspect partial state when an upgrade fails.
Review before activation
A copied skill can contain instructions, executable scripts and references to external services. The installer checks selected paths and the presence of SKILL.md, but does not conduct a behavioral security review of the entire folder. Treat installation, host activation, credential access and externally visible actions as distinct decisions, with the narrowest permissions needed for the intended task.
The archive containment check is valuable but answers only where members may be extracted under its path-resolution model. It does not decide whether the installed workflow should run shell commands, read private logs or send data to another service. Review those capabilities in the actual selected scripts and in the host’s enforceable tool policy.
Know which credentials and evidence are involved
github_utils.py takes GITHUB_TOKEN first and GH_TOKEN second when constructing its authorization header. The download path requests public GitHub infrastructure, while the Git fallback can use existing Git credentials and SSH configuration. This source observation is not a reason to print environment variables, copy tokens into a manuscript or broaden repository access to get a sample working.
CI logs and issue text are untrusted task data. They may contain secrets, misleading instructions or incidental strings that match a diagnostic heuristic. The gh-fix-ci workflow asks for approval before implementation, but prose alone is not a sandbox. Enforce tool restrictions independently and redact sensitive evidence before including snippets in reports or model context.
Operate with explicit rollback and scope
An existing destination is refused, which protects against a casual overwrite but does not supply a versioned upgrade mechanism. Multiple copies can partially succeed, and the local listing only annotates names. Keep a revision manifest and a recoverable previous package; verify the actual folder after failures rather than assuming an exit code describes an all-or-nothing state.
The helper’s extraction of run IDs from URL paths is not an origin allowlist, and the minimal frontmatter validator is not a permissions validator. These are integration boundaries to handle explicitly. This article reports inspected behavior and narrow tests; it is not a penetration-test result, an assertion of exploitable vulnerability or a certification that any particular deployed host is safe.
Implementation steps
- 1
Inventory scripts, endpoints and credential requirements.
- 2
Restrict the host to the selected task and approved data.
- 3
Treat logs as untrusted evidence and redact sensitive material.
- 4
Rehearse rollback with an isolated reviewed package.
Copy-ready example
{"installAuthorizesExternalWrites":false,"metadataIsSandbox":false,"logTextIsTrustedInstruction":false,"revisionRecorded":true,"liveSecurityAssessmentPerformed":false}Frequently asked questions
Does declaring a dependency grant its credentials?
No. A metadata declaration is separate from connection setup, account authorization and the host’s execution policy.
Should I delete an existing skill to bypass a collision?
Not automatically. Preserve it, identify the intended upgrade and rollback paths, and verify the replacement before changing an active installation.
Sources
- README.mdSource checked 2026-09-08
- skills/.system/skill-installer/SKILL.mdSource checked 2026-09-08
- skills/.system/skill-installer/LICENSE.txtSource checked 2026-09-08
- skills/.system/skill-installer/scripts/install-skill-from-github.pySource checked 2026-09-08
- skills/.system/skill-installer/scripts/github_utils.pySource checked 2026-09-08
- skills/.system/skill-installer/scripts/list-skills.pySource checked 2026-09-08
- skills/.system/skill-creator/scripts/quick_validate.pySource checked 2026-09-08
- skills/.system/skill-creator/references/openai_yaml.mdSource checked 2026-09-08
- skills/.curated/gh-fix-ci/SKILL.mdSource checked 2026-09-08
- skills/.curated/gh-fix-ci/scripts/inspect_pr_checks.pySource checked 2026-09-08
- skills/.curated/gh-fix-ci/agents/openai.yamlSource checked 2026-09-08
- skills/.system/plugin-creator/SKILL.mdSource checked 2026-09-08
- Current official skills guideSource checked 2026-09-08