trusted-capabilities

Discover, evaluate, safely install, and update reusable skills from a curated set of trusted open-source repositories.

Repository: sonichi/sutando
Last source activity: August 3, 2026 at 04:48
Detected SKILL.md language: English
Stars: 388
Forks: 85

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/sonichi/sutando --skill trusted-capabilities

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

Trusted capabilities

Use this skill when the owner asks to find, assess, install, or update reusable agent skills and tools from public ecosystems.

The catalog is allowlist-only. Skill sources can be installed after inspection. Tool sources can be discovered and statically inspected, while tool and index sources remain install-disabled because their setup and runtime permissions are project-specific.

C=skills/trusted-capabilities/scripts/catalog.py python3 "$C" sources python3 "$C" search browser python3 "$C" inspect openai-skills skills/.curated/browser-automation python3 "$C" inspect mcp-reference-servers src/filesystem python3 "$C" install openai-skills skills/.curated/browser-automation # Review the dry-run output, then copy its exact commit into the write: python3 "$C" install openai-skills skills/.curated/browser-automation --commit <40-char-sha> --yes python3 "$C" update browser-automation python3 "$C" update browser-automation --commit <40-char-sha> --yes

install and update show the resolved commit, destination, and risk findings, then print a write command pinned to that immutable commit. Writes require both the full --commit <sha> from the reviewed dry run and --yes; resolving the moving default branch again is not authorization to write. Updates also re-check that the source remains installable in the current allowlist. The default destination is the runtime's canonical $CLAUDE_CONFIG_DIR/skills/ path via src/util_paths.py. Use --dest-root for an explicit test or alternate install root.

Every install is pinned to a Git commit, fetched file-by-file, bounded by file count and total size, and written atomically. Provenance is recorded in .sutando-source.json; update uses it to compare and fetch the same upstream path.

name	trusted-capabilities
description	Discover, evaluate, safely install, and update reusable skills from a curated set of trusted open-source repositories.