| name | trusted-capabilities |
| description | Discover, evaluate, safely install, and update reusable skills from a curated set of trusted open-source repositories. |
Trusted capabilities
Use this skill when the owner asks to find, assess, install, or update reusable
agent skills and tools from public ecosystems.
The catalog is allowlist-only. Skill sources can be installed after inspection.
Tool sources can be discovered and statically inspected, while tool and index
sources remain install-disabled because their setup and runtime permissions are
project-specific.
C=skills/trusted-capabilities/scripts/catalog.py
python3 "$C" sources
python3 "$C" search browser
python3 "$C" inspect openai-skills skills/.curated/browser-automation
python3 "$C" inspect mcp-reference-servers src/filesystem
python3 "$C" install openai-skills skills/.curated/browser-automation
python3 "$C" install openai-skills skills/.curated/browser-automation --commit <40-char-sha> --yes
python3 "$C" update browser-automation
python3 "$C" update browser-automation --commit <40-char-sha> --yes
install and update show the resolved commit, destination, and risk findings,
then print a write command pinned to that immutable commit. Writes require both
the full --commit <sha> from the reviewed dry run and --yes; resolving the
moving default branch again is not authorization to write. Updates also
re-check that the source remains installable in the current allowlist. The
default destination is the runtime's canonical $CLAUDE_CONFIG_DIR/skills/
path via src/util_paths.py. Use --dest-root for an explicit test or
alternate install root.
Every install is pinned to a Git commit, fetched file-by-file, bounded by file
count and total size, and written atomically. Provenance is recorded in
.sutando-source.json; update uses it to compare and fetch the same upstream
path.
