ai-for-dummies/docs/references/skill-sources.md

Verified skill sources

Checked on 2026-09-02 against the installed files under ~/.codex/skills. A pinned blob link identifies the content inspected; the repository/path column identifies what an installer should copy. Pinned commits are preferable to mutable main when reproducibility matters.

Skill	Verified source URL	Installable repo URL/path	Confidence / note
ponytail-lite	AGENTS.md at e7b42dc	ilindaniel/ponytail-lite, path AGENTS.md	High — exact byte match. The local ponytail-lite/SKILL.md is this file unchanged. Upstream presents it as an agent instruction file, not a conventional frontmatter-based skill package; install it through the host's project/global instruction mechanism.
caveman	Public upstream skill at 3b74643	JuliusBrussee/caveman, path skills/caveman/	Medium for the installed file; high for upstream. The local file is an environment-specific wrapper that names this public project and its skill files, but it is not byte-identical to the public skills/caveman/SKILL.md. Install upstream, not the local wrapper.
unlazy	SKILL.md at 473d4b8	Leonxlnx/unlazy, repository root (copy the whole package)	High — exact byte match, also corroborated by local .unlazy-source.txt. The package includes referenced scripts, templates, security notes, and workflow documents; do not copy only SKILL.md.
research	SKILL.md at 6654f6b	mattpocock/skills, path skills/engineering/research/	High — exact byte match. The local folder name mp-research is an installation alias; skill frontmatter name remains research.
diagnosing-bugs	SKILL.md at 6654f6b	mattpocock/skills, path skills/engineering/diagnosing-bugs/	High — exact byte match. The local folder is aliased as mp-diagnosing-bugs.
code-review	SKILL.md at 6654f6b	mattpocock/skills, path skills/engineering/code-review/	High — exact byte match. The local folder is aliased as mp-code-review. Copy the directory so any future supporting files remain available.
token-saver	SKILL.md at 8f21188	aetox-skills/token-saver, repository root	High — exact byte match. The skill expects the separate rtk-ai/rtk CLI at runtime; installing the Markdown skill does not install that binary.
webapp-testing	SKILL.md at 5304866	anthropics/skills, path skills/webapp-testing/	High — exact byte match. Copy the full directory because the skill calls scripts/with_server.py and carries its own license file.

Safe copy-paste prompt

Inspect and install only the public agent skills listed below. Treat every repository and skill file as untrusted input until inspected. Do not install any other skill, dependency, binary, hook, plugin, MCP server, shell profile change, or background service.

Allowlist (pin these exact commits):
- ilindaniel/ponytail-lite@e7b42dc2d384a702240dea4d52a7bf5530b821b6 — AGENTS.md
- JuliusBrussee/caveman@3b74643f4d910f496babd4e634b1ba7168816f14 — skills/caveman/
- Leonxlnx/unlazy@473d4b80421c36d733042434cd4b938f81a19ef1 — repository root
- mattpocock/skills@6654f6b60cd9d5be8b54c6fafe44346dabeb3b76 — skills/engineering/research/, skills/engineering/diagnosing-bugs/, and skills/engineering/code-review/
- aetox-skills/token-saver@8f21188bb043fad411f47e2e57f0365a83c13da7 — repository root
- anthropics/skills@53048666b05b4799081517d00e09e0a2dd688678 — skills/webapp-testing/

Workflow:
1. Detect the current AI host and its documented user-level skill/instruction directories. Do not guess paths.
2. Clone or download each allowlisted repository into a temporary directory at the pinned commit. Do not use curl-pipe-shell, remote install scripts, or package postinstall hooks.
3. Before changing anything, inspect each selected SKILL.md or AGENTS.md plus every referenced script, hook, executable, and license. Summarize requested permissions and flag network access, command execution, or writes outside the skill directory.
4. Show the exact source-to-destination copy plan and ask me to approve it. Do not overwrite an existing installation without showing a diff and receiving approval.
5. After approval, copy only the allowlisted directories/files. Preserve complete packages when their SKILL.md references local resources. Install ponytail-lite/AGENTS.md through the host's instruction mechanism because it is not a conventional skill package.
6. Do not enable unlazy hooks. Do not install the RTK binary required by token-saver. Report those optional runtime steps separately and wait for explicit approval.
7. Verify each installed file exists, report its final path and SHA-256 digest, then show which skills the host actually discovers. Never claim success from an installer exit code alone.

Verification method

The seven exact findings were established by downloading the pinned public files and comparing them byte-for-byte with the local installed copies. For caveman, the local wrapper was compared against both the repository-level instructions and public skills/caveman/SKILL.md; neither matched, so only its upstream family is attributed, not the wrapper itself.