SkillRadar README

The project's README from github.com/changchangidea-oss/SkillRadar. As one markdown file: README.md.

SkillRadar

Open-source discovery, security, ranking, and routing infrastructure for Agent Skills and Codex.

Release Daily Radar Router Benchmark Security Guard MIT Agent Skills Stars

SkillRadar overview

Give SkillRadar a coding task. It returns a small, safety-gated, evidence-backed set of Agent Skills instead of asking you to install an entire skill catalog.

SkillRadar discovers public SKILL.md files, parses their real contents, performs conservative static security checks, ranks candidates, bundles an offline registry, and routes tasks to relevant Skills without automatically executing untrusted third-party code.

Try it in 60 seconds

Codex Plugin

Install or verify the Codex CLI first:

command -v codex >/dev/null 2>&1 || npm install -g @openai/codex
codex --version

Then add the marketplace and install the plugin:

codex plugin marketplace add changchangidea-oss/SkillRadar --ref v0.5.0 && codex plugin add skillradar@skillradar

If your shell still says codex: command not found, restart the terminal and make sure your global npm binary directory is on PATH before retrying the plugin command.

Start a fresh Codex thread and run:

$skill-router
Find the best skills for a Next.js AI dashboard with tool calling and shadcn/ui.

A successful route should give you a small Top-3 result with auditable fields such as:

The installed plugin is offline-first and registry-first for explicit routing. Normal Top-3 routing does not require cloning this repository or fetching GitHub Raw.

Standard Agent Skill / skills.sh ecosystem

npx skills add changchangidea-oss/SkillRadar --skill skillradar

The standard Skill is intentionally read-first: discovery does not authorize third-party execution.

Local registry UI

git clone https://github.com/changchangidea-oss/SkillRadar.git
cd SkillRadar
npm run validate
npm run benchmark:router
npm run serve

Open http://localhost:4173.

Tried it? Tell us what happened

Real usage is more useful than synthetic demos.

Please remove tokens, credentials, private source code, and other sensitive data before posting.

Why SkillRadar exists

Installing hundreds of Skills is the wrong optimization. It increases context pressure, makes provenance harder to track, and turns task routing into guesswork.

SkillRadar takes the opposite approach:

What makes it different

Safety-gated discovery

Every discovered candidate passes through parsing and static security analysis. D/Blocked candidates remain audit-only and cannot enter the bundled routing shard.

Technology-specific evidence

Named technologies and services should be supported by specific evidence. Generic words such as workflow, integration, or data are not enough to justify a recommendation for a named tool or framework.

If the registry lacks a relevant capability, SkillRadar can expose that gap instead of filling Top-3 with unrelated Skills.

Offline-first explicit routing

The Codex plugin ships with a complete safety-gated core + design + general registry snapshot. Explicit routing can operate from the bundled registry without executing candidate repositories or depending on live GitHub discovery.

Auditable ranking

A route exposes relevance, SkillRadar score, security, provenance, reason, and match details so a recommendation can be inspected instead of treated as a black box.

Discovery coverage

SkillRadar combines the 12-field Design Radar with a General Agent Skills Radar across 10 domains:

AI Agents · Frontend · Backend & API · Data & Database · Testing & Quality · DevOps & Cloud · Security · Mobile · Automation & Integrations · Docs & Research.

General discovery combines multiple channels rather than relying on one repository query:

Candidates record discovery channels, coverage, domain evidence, quality, maintenance, popularity, security findings, and provenance.

Operational coverage is written to data/general-radar-latest.json; the auditable candidate pool is data/general-radar-registry.json.

Matching v2.1

Raw substring matching is not enough. Matching v2.1:

Project context is deliberately narrow: dependency names, common config filenames, and framework directories may be read. Source-file contents, environment-variable values, credentials, and candidate third-party scripts are not used for project-context routing.

If a C-grade Skill ranks first and an A/B candidate is within five match-score points, SkillRadar surfaces a safer-alternative advisory.

Router Quality Benchmark

The repository includes a golden benchmark so ranking changes have a measurable contract instead of relying on subjective spot checks.

The v0.5 baseline recorded:

The multi-capability AI Dashboard case is intentionally strict: the Top-3 must include nextjs, ai-sdk, and shadcn, proving that the reranker covers distinct explicit task facets instead of filling slots with generic near-matches.

Benchmark inputs live in data/router-benchmark.json; the latest auditable result is committed to data/router-benchmark-latest.json. CI and the release workflow enforce the benchmark. Weight changes remain code-reviewed and benchmark-gated.

Skill Budget Doctor

Current Codex has a finite model-visible Skill metadata budget; crowded catalogs can create context pressure. $manage-skills uses a read-only doctor instead of generic cleanup advice.

It inventories user, project, and enabled plugin Skills, estimates catalog pressure, detects near duplicates, uses current project/task relevance as a pruning signal, and generates:

It does not edit ~/.codex/config.toml, disable Skills, uninstall plugins, or execute discovered scripts without a later explicit approval.

Architecture

flowchart LR
  GH[Public GitHub repositories] --> DR[Design Radar]
  GH --> GR[General Radar]
  DR --> S[Parse + security scan]
  GR --> S
  S -->|A / B / C| R[Classify + rank]
  S -->|D / Blocked| A[Audit-only pool]
  R --> REG[(Safety-gated registry)]
  REG --> SNAP[(Bundled core + design + general snapshot)]
  SNAP --> M[Matching v2.1]
  M --> Q[Router Quality Benchmark]
  M --> CODEX[Codex $skill-router]
  CODEX --> T[Top-3 task match]
  CODEX --> B[Skill Budget Doctor]

Safety boundary

Discovery is not execution.

The scanner looks for high-risk patterns and capabilities including destructive shell commands, pipe-to-shell installs, remote shell use, dynamic execution, secret access, networking, package installation, filesystem writes, git writes, and deploy tooling.

Grades are conservative:

This is not a formal security audit or sandbox. The goal is to make risk visible before an agent installs or runs something.

Codex Plugin

The plugin lives in packages/codex-plugin/ and includes:

A repository-level Codex marketplace lives at .agents/plugins/marketplace.json, so Codex can install directly from GitHub. The plugin filters D/Blocked candidates again at runtime as defense in depth.

Repository map

SkillRadar/
├── .agents/plugins/marketplace.json
├── .github/ISSUE_TEMPLATE/
├── skills/skillradar/SKILL.md
├── data/
│   ├── skills.json
│   ├── design-skills-*.json
│   ├── general-domains.json
│   ├── general-skills-radar.json
│   ├── general-radar-registry.json
│   ├── general-radar-latest.json
│   ├── router-benchmark.json
│   └── router-benchmark-latest.json
├── packages/codex-plugin/
│   ├── data/registry.json
│   ├── scripts/skillradar.mjs
│   ├── scripts/skill-budget.mjs
│   └── skills/
├── docs/ADOPTION.md
├── scripts/
└── .github/workflows/

Open-source operating model

The repository intentionally keeps evidence in public Git history. Daily bots commit generated Radar data and refreshed bundled snapshots; benchmark and routing-quality evidence remain inspectable; CI verifies security patterns, registry integrity, project-context boundaries, plugin-only offline routing, Router Quality Benchmark behavior, Skill Budget Doctor behavior, and public marketplace installation.

We do not manufacture Stars, Forks, installs, contributor activity, testimonials, or feedback. See docs/ADOPTION.md for the evidence rules used by the project.

Public pages

Contributing

Code contributions and usage reports are both useful. See CONTRIBUTING.md.

Useful contributions include new public Skill sources, safety rules/fixtures, domain taxonomy improvements, ranking improvements, benchmark cases, OS compatibility tests, UI/metrics improvements, install reports, and real routing feedback.

Release

See v0.5.0 release notes.

License

MIT — see LICENSE.

SkillRadar (changchangidea-oss/SkillRadar)

Searching Database…

190 ·GitHub
SkillRadar
What is this?SkillRadar is open-source discovery, security, ranking, and routing infrastructure for Agent Skills and Codex: give it a coding task and it returns a small, safety-gated, evidence-backed Top-3 set of relevant Skills instead of making you install an entire skill catalog.
Is this a Codex plugin or a standalone tool?It ships mainly as a Codex plugin with four commands (skill-router, find-skill, inspect-skill, manage-skills), but underneath it is a full discovery/ranking engine with its own bundled registry data and router benchmark that the plugin sits on top of.
How do I get SkillRadar running in Codex?Install or verify the Codex CLI first, then add the SkillRadar marketplace and install the plugin, and start a fresh Codex thread to run a task; a successful route returns a Top-3 result with auditable fields like matchscore, skillradarscore, and security.
Do I need anything besides the Codex CLI?You just need the Codex CLI with npm's global binary directory on your PATH; the installed plugin is offline-first and registry-first, so normal Top-3 routing doesn't require cloning the repo or hitting GitHub Raw.
Does it actually run or fully audit the Skills it finds?No — discovery is explicitly not execution, so it won't automatically run untrusted third-party code, and its static risk grading (A through D/Blocked) is stated to not be a formal security audit or sandbox, just a way to surface risk before you install or run something.
What is the Skill Budget Doctor?It is the manage-skills command, a read-only auditor that inventories user, project, and plugin Skills, estimates catalog context pressure, detects near-duplicates, and suggests config snippets to disable redundant ones — without ever editing config files or disabling anything itself.
How is SkillRadar's matching smarter than plain keyword search?Matching v2.1 recognizes concepts and phrases, avoids short-token substring mistakes such as ai matching tailwind, weights identity/tags/domains/summary differently, and complementary-reranks the Top 3 so the results cover distinct facets of the task instead of near-duplicate matches.
Is there proof that ranking changes don't break results?Yes, the repo ships a Router Quality Benchmark with golden routing cases; the v0.5 baseline passed 7/7 cases with zero D/Blocked results in the Top-3 and an average Top-1 match score of 85.1, and CI enforces this benchmark on every change.
Why did the author build this instead of just installing lots of Skills?Installing hundreds of Skills increases context pressure, makes provenance hard to track, and turns task routing into guesswork, so SkillRadar keeps discovery broad while keeping the Skills actually loaded into an agent's context small and evidence-backed.
What are similar projects?rea, DSH-Plugins-Marketplace, rea, ECC, clawhub, skills, dsh-crew, CLI-Anything
Which topics is it in?ai-agent-tools, registry, static-analysis, search, agentic-ai, benchmark, plugin, agent-skills, codex, agent, security, npm
Creator
changchangidea-oss
Size
8.8 MB
Stars
190
Updated
CommitOct 18Releasev0.5.0Aug 26
Age
1mo
Commits · 90 Days