OpenAI Skills
OpenAI Skills source analysis: URL splitting, ZIP preflight and misleading log markers
Reproduce three narrow source behaviors: slash-containing refs, archive path checks before extraction, and a last-match log heuristic that can select “0 failures.”
What you will learn
- Trace inputs before discussing algorithms
- Preflight an archive, then extract
- Read a heuristic as a heuristic
Before you start
- Basic Git, Python and command-line concepts
- An explicit boundary for permitted repository inspection and changes
Explain the chapter’s source behavior and apply its acceptance checklist without confusing a catalog with its host.
Key takeaways
- Separate ref and path when URL segments cannot express the intended branch clearly.
- ZIP member checks run before extraction but do not vet executable content.
- A diagnostic substring match is a lead, not a root-cause proof.
Trace inputs before discussing algorithms
The installer parses a GitHub URL into owner, repository, ref and path. For /tree/feature/demo/skills/example it returns ref feature and path demo/skills/example; it does not infer that feature/demo might be one branch name. Our hash-checked Python probe reproduced that exact result. Prefer separate ref and path arguments when reconstructing a source location with such a branch.
Its relative-path check rejects absolute paths and normalized strings beginning with two dots. That is deliberately simple and can also reject a name such as ..notes, not only an actual parent traversal. Name validation is a separate single-segment check that uses platform separators. These checks should be described at their real scope, not promoted into a universal cross-platform repository verifier.
Preflight an archive, then extract
The ZIP helper resolves every member’s destination using realpath and requires it to equal the destination root or begin with the root plus the platform separator. Only after the entire member loop passes does it call extractall. A fake archive containing a normal member followed by ../escape.txt was rejected before its fake extraction method ran.
This probe verifies the ordering and selected path branches without unpacking real files. It does not test archive resource exhaustion, malicious payload execution, concurrent filesystem changes or every operating system. Archive containment is a useful boundary, but a skill can still contain commands that are inappropriate to run after it has been copied safely.
Read a heuristic as a heuristic
The CI helper scans log lines backward for substrings including error, fail, traceback and timeout. It then selects a bounded window around the last matching line. The phrase “0 failures” still contains fail, so our invented log placed the marker there rather than at an earlier actual error. This is a counterexample to treating the extracted snippet as a proven root cause.
The JavaScript below is an independent miniature of the last-substring-match idea, not the complete Python helper. It returns index 2 for the supplied lines and -1 when nothing matches. The real source has a larger marker list and additional window logic. We ran the miniature in all three language editions and isolated Python functions; no GitHub account, installation or live agent task was used.
Implementation steps
- 1
Predict the ref/path tuple for a slash-containing branch URL.
- 2
Check that a late invalid ZIP member prevents extraction.
- 3
Compare an actual error line with a later “0 failures” line.
- 4
Confirm the diagnosis against full context before proposing changes.
Copy-ready example
function lastMarker(lines) {
for (let i = lines.length - 1; i >= 0; i--) {
if (["error", "fail", "timeout"].some(word => lines[i].toLowerCase().includes(word))) return i;
}
return -1;
}
console.log(lastMarker(["ERROR first", "work", "0 failures"]));Frequently asked questions
Did the archive probe extract any files?
No. It used a fake archive with a recorded extractall call. The unsafe-member case prevented that call entirely.
Is the JavaScript example copied from the repository?
No. It is an independent teaching model of one heuristic. The actual Python functions were tested separately against the pinned source hashes.
Sources
- README.mdSource checked 2026-09-08
- skills/.system/skill-installer/SKILL.mdSource checked 2026-09-08
- skills/.system/skill-installer/LICENSE.txtSource checked 2026-09-08
- skills/.system/skill-installer/scripts/install-skill-from-github.pySource checked 2026-09-08
- skills/.system/skill-installer/scripts/github_utils.pySource checked 2026-09-08
- skills/.system/skill-installer/scripts/list-skills.pySource checked 2026-09-08
- skills/.system/skill-creator/scripts/quick_validate.pySource checked 2026-09-08
- skills/.system/skill-creator/references/openai_yaml.mdSource checked 2026-09-08
- skills/.curated/gh-fix-ci/SKILL.mdSource checked 2026-09-08
- skills/.curated/gh-fix-ci/scripts/inspect_pr_checks.pySource checked 2026-09-08
- skills/.curated/gh-fix-ci/agents/openai.yamlSource checked 2026-09-08
- skills/.system/plugin-creator/SKILL.mdSource checked 2026-09-08
- Current official skills guideSource checked 2026-09-08