trusted-capabilities

name	trusted-capabilities
description	Discover, evaluate, safely install, and update reusable skills from a curated set of trusted open-source repositories.

Trusted capabilities

Use this skill when the owner asks to find, assess, install, or update reusable agent skills and tools from public ecosystems.

The catalog is allowlist-only. Skill sources can be installed after inspection. Tool sources can be discovered and statically inspected, while tool and index sources remain install-disabled because their setup and runtime permissions are project-specific.

C=skills/trusted-capabilities/scripts/catalog.py
python3 "$C" sources
python3 "$C" search browser
python3 "$C" inspect openai-skills skills/.curated/browser-automation
python3 "$C" inspect mcp-reference-servers src/filesystem
python3 "$C" install openai-skills skills/.curated/browser-automation
# Review the dry-run output, then copy its exact commit into the write:
python3 "$C" install openai-skills skills/.curated/browser-automation --commit <40-char-sha> --yes
python3 "$C" update browser-automation
python3 "$C" update browser-automation --commit <40-char-sha> --yes

install and update show the resolved commit, destination, and risk findings, then print a write command pinned to that immutable commit. Writes require both the full --commit <sha> from the reviewed dry run and --yes; resolving the moving default branch again is not authorization to write. Updates also re-check that the source remains installable in the current allowlist. The default destination is the runtime's canonical $CLAUDE_CONFIG_DIR/skills/ path via src/util_paths.py. Use --dest-root for an explicit test or alternate install root.

Every install is pinned to a Git commit, fetched file-by-file, bounded by file count and total size, and written atomically. Provenance is recorded in .sutando-source.json; update uses it to compare and fetch the same upstream path.