Skip to content
IFAI

How to use Skills

A Skill is a folder with a SKILL.md file in it. Put it in your AI assistant’s Skills directory and the assistant uses it when a task calls for it. Every version listed on IFAI is security-checked and reviewed by IFAI.

Use a Skill in three steps

  1. Pick a SkillBrowse by category or search, then open a Skill to see what it does and what it needs: an API key, network access, other tools.
  2. Install it in your assistantOn the Skill’s page, choose your assistant, press “Copy install instruction” and paste it to the assistant. It reads the install steps, downloads the Zip, checks its fingerprint and puts it in its Skills directory. Or press “Download Zip” and unzip it yourself into one of the directories below.
  3. Ask for what you needNo commands to learn: say what you want done, as usual, and the assistant uses the Skill when it fits. Some assistants need a new session or a setting first; see the notes below.

Where each assistant keeps Skills

Unzip it into a folder named after the Skill’s slug (the line under its name), inside one of these directories, so that SKILL.md ends up at:

<Skills directory>/<slug>/SKILL.md

  • Claude Code

    Website
    All projects
    ~/.claude/skills/
    One project
    .claude/skills/

  • Codex

    Website

    Where its Skills go is not written up here yet; see its documentation.

  • OpenClaw

    Where its Skills go is not written up here yet; see its documentation.

  • Hermes

    Where its Skills go is not written up here yet; see its documentation.

  • Pi

    Where its Skills go is not written up here yet; see its documentation.

  • WorkBuddy

    Where its Skills go is not written up here yet; see its documentation.

Check the fingerprint

Every version has a sha256 fingerprint computed from the Zip itself. It is on the Skill’s page under “Fingerprint” and in the install steps. Check a download against it, so you know you have the same file IFAI reviewed:

macOS and Linux

shasum -a 256 <slug>-<version>.zip
sha256sum <slug>-<version>.zip

Windows (PowerShell)

Get-FileHash <slug>-<version>.zip -Algorithm SHA256

Install it only if the result is the same as on the page (Windows prints capital letters; that does not matter). If it differs, download it again; if it still differs, do not install it.

The install steps ask your assistant to check the fingerprint as well, and to stop and tell you if it does not match.

What the security check covers

  • Every version is checked when it is imported. One with a broken package, a hard-coded key, or code that reads sensitive places such as ~/.ssh cannot be published.
  • Dangerous commands, network access it did not declare and signs of prompt injection are flagged, and IFAI looks at them before the version is published.
  • The install steps only say where the files go, and tell the assistant not to run anything from the package.
  • The check reads the files; it cannot prove a Skill is safe. Before installing, look at the “Security check” tab: the domains it contacts, the files it touches, and the tools and API keys it needs.
All Skills