skillZs
★ LIVE SKILL TAGS ★
>>> LIVE SKILLS INDEX <<<
* OPEN SOURCE *
NO LOGIN, NO TRACKING
※ REAL INSTALL DATA ※
← back to all skills
kkkkhazix/khazix-skills260 installs

github-to-skills

Automated factory for converting GitHub repositories into specialized AI skills. Use this skill when the user provides a GitHub URL and wants to "package", "wrap", or "create a skill" from it. It automatically fetches repository details, latest commit hashes, and generates a standardized skill structure with enhanced metadata suitable for lifecycle management.

How do I install this agent skill?

npx skills add https://github.com/kkkkhazix/khazix-skills --skill github-to-skills
view source ↗

Is this agent skill safe to install?

  • Gen Agent Trust Hubfail

    This skill acts as a factory that creates new AI skills from GitHub repositories. It is highly vulnerable to Indirect Prompt Injection and Code Injection because it downloads untrusted data (README files and repository names) and uses that content to generate instructions and scripts for new skills without any sanitization or boundary markers. A malicious repository could hijack the agent during the creation process or compromise the generated skill.

  • Socketpass

    No alerts

  • Snykwarn

    Risk: MEDIUM · No issues

  • Runlayerwarn

    3/3 files flagged

What does this agent skill do?

GitHub to Skills Factory

This skill automates the conversion of GitHub repositories into fully functional AI skills.

Core Functionality

  1. Analysis: Fetches repository metadata (Description, README, Latest Commit Hash).
  2. Scaffolding: Creates a standardized skill directory structure.
  3. Metadata Injection: Generates SKILL.md with extended frontmatter (tracking source, version, hash) for future automated management.
  4. Wrapper Generation: Creates a scripts/wrapper.py (or similar) to interface with the tool.

Usage

Trigger: /GitHub-to-skills <github_url> or "Package this repo into a skill: <url>"

Required Metadata Schema

Every skill created by this factory MUST include the following extended YAML frontmatter in its SKILL.md. This is critical for the skill-manager to function later.

---
name: <kebab-case-repo-name>
description: <concise-description-for-agent-triggering>
# EXTENDED METADATA (MANDATORY)
github_url: <original-repo-url>
github_hash: <latest-commit-hash-at-time-of-creation>
version: <tag-or-0.1.0>
created_at: <ISO-8601-date>
entry_point: scripts/wrapper.py # or main script
dependencies: # List main dependencies if known, e.g., ["yt-dlp", "ffmpeg"]
---

Workflow

  1. Fetch Info: The agent first runs scripts/fetch_github_info.py to get the raw data from the repo.
  2. Plan: The agent analyzes the README to understand how to invoke the tool (CLI args, Python API, etc.).
  3. Generate: The agent uses the skill-creator patterns to write the SKILL.md and wrapper scripts, ensuring the extended metadata is present.
  4. Verify: Checks if the commit hash was correctly captured.

Resources

  • scripts/fetch_github_info.py: Utility to scrape/API fetch repo details (README, Hash, Tags).
  • scripts/create_github_skill.py: Orchestrator to scaffold the folder and write the initial files.

Best Practices for Generated Skills

  • Isolation: The generated skill should install its own dependencies (e.g., in a venv or via uv/pip) if possible, or clearly state them.
  • Progressive Disclosure: Do not dump the entire repo into the skill. Only include the necessary wrapper code and reference the original repo for deep dives.
  • Idempotency: The github_hash field allows the future skill-manager to check if remote_hash != local_hash to trigger updates.

How can the creator link this skill?

Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.

<a href="https://skillzs.dev/skills/kkkkhazix/khazix-skills/github-to-skills">View github-to-skills on skillZs</a>