The catalog was deprecated in June 2026
OpenAI deprecated this 44-package catalog on June 22, 2026, and the README now opens with a warning. New examples live in openai/plugins, while the official Codex guide explains how to author a skill and package it for distribution. That makes this repository a reference collection for existing users. Starting a new public extension here would ignore the maintainer's stated direction.
The old catalog model is still easy to understand. A skill is a folder with SKILL.md instructions and optional scripts, references, assets, and agent metadata. Codex discovers a matching skill from its name and description, then reads the full instructions when needed. That progressive loading is useful because a long catalog does not have to occupy the agent's working context all at once.
Forty-four skill packages show the format in real use
The openai/skills tree contains 39 curated packages and 5 system packages. They cover jobs such as CLI creation, Cloudflare deployment, document work, image creation, spreadsheet handling, and skill installation. Many packages go beyond a single prompt: they include Python or JavaScript helpers, reference files, images, and agents/openai.yaml metadata. The examples are the strongest reason to keep this repository bookmarked.
Those 44 packages do not form one application. Each skill has its own scope, dependencies, and license file, and the repository has no single GitHub license classification. A team reusing code or assets must inspect the chosen directory instead of treating the catalog as one uniformly licensed package. The same rule applies to setup: a Markdown-only skill and a skill that calls a local script create different review work.
What happened when we ran it
Our measurement setup examined commit 49f948f on 2026-09-06 in an unprivileged Debian container with 3 CPUs and 8 GB of RAM. The harness classified the repository as Python, but it found no supported ecosystem to execute and no Dockerfile. It stopped before installation, so there is no build outcome, test count, dependency total, audit result, or timing to report.
That result says nothing about whether an individual skill gives good instructions inside Codex. It says the repository cannot be judged like a Python package from the run path our lab had available. Testing one entry would require selecting that skill, installing it through a compatible Codex version, supplying any tools it declares, and checking the files or external actions it produces. We did not perform that separate workflow.
New distribution requires a plugin manifest
OpenAI's current plugin format requires 1 manifest file named .codex-plugin/plugin.json. A plugin can hold one or more skills and can also refer to an MCP server connection or bundle server configuration. Local skill folders still work for authoring and repository-specific use, but the plugin directory is the route for something other people should install. This repository predates that packaging center of gravity.
The difference matters for maintenance. Copying an old skill folder may preserve its instructions, yet it does not create the current manifest, marketplace entry, compatibility metadata, or optional connector wiring. openai/plugins provides current public examples. For a new project, begin there and use this catalog only when an older skill contains a useful technique or reference worth adapting.
The bundled installer has an open symlink report
One open security issue, number 534, says the Git-based installer copies a selected directory with Python's default copytree behavior. According to the September 1, 2026 report, a symlink inside that directory can point outside it and cause other checked-out files to be copied into the destination. The reporter describes this as local file-copy hardening, not remote code execution by itself.
That is enough reason to inspect third-party skill repositories before installation. Skills are instructions an agent may follow, and some contain executable helpers. Review SKILL.md, follow symlinks, inspect scripts, and note the destination path before exposing the skill to a working repository. The official source label reduces provenance uncertainty for this catalog; it does not turn every future Git URL into trusted input.
Two setup reports make the old path harder to recommend
Two open issues document routine setup trouble. Issue 420 describes a Windows Codex Desktop installation where the bundled tools targeted ~/.codex/skills while newer public guidance pointed toward .agents/skills. Issue 518 reports that quick_validate.py exits with ModuleNotFoundError: No module named 'yaml' when PyYAML is absent globally, although that dependency was not documented in the reported setup.
Neither report proves every installation is broken. Both remained open after the repository's last recorded push on July 14, 2026. A maintainer of an existing setup can pin the known directory and provision PyYAML when needed. A newcomer gets a cleaner answer by following the current plugin documentation rather than reconciling retired catalog behavior.
Issue activity continued after code pushes stopped
GitHub reported 25,510 stars and 292 combined open issues and pull requests on September 6, 2026. The repository's last push was July 14, while issue 535 received activity on September 5. There is no latest tagged release returned by GitHub. The project therefore has current user attention, but its own README settles the product question: maintenance traffic does not reverse the deprecation.
OpenAI Skills has 44 packages that remain useful as source material. They show how substantial skills divide instructions, references, scripts, and assets. For active distribution, OpenAI Plugins is the direct successor, Anthropic Skills is a useful format comparison, and Superpowers is the better fit for teams seeking a maintained coding workflow. Choose this repository only when you know which older skill you came to study.