CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

openai-platform-api-key

Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool, especially requests phrased only as "using AI" or generators driven by forms/user input; also use for OPENAI_API_KEY or sk-proj setup. Do not gate model or prompt migrations that can proceed with source edits and offline validation. Otherwise treat this as the credential gate: inspect safely, ask reuse-vs-new before API work, and never expose plaintext.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable, well-sequenced credential-gating policy: exact tool names and arguments, verbatim user-facing questions, executable helper commands, hard-stop checkpoints, and error-recovery loops. Its one real weakness is redundancy — the migration exception, the reuse-vs-new decision, and env-file preference rules are each restated across two or three sections.

Suggestions

State the model/prompt-migration exception once (e.g., in 'When To Use') and refer back to it from 'Coordination With Implementation Skills' and 'Mandatory First Step' instead of restating it three times.

Consolidate the reuse-vs-new question into a single authoritative section — it is currently specified in 'Mandatory First Step', 'Credential Decision Messages', and Workflow step 2 — and keep the other sections as brief pointers.

Deduplicate repeated guidance such as 'prefer ignored or untracked env files; avoid tracked targets', which appears in both Safety Rules and Workflow step 1.

DimensionReasoningScore

Conciseness

The body contains no padding or explanations of concepts Claude already knows, but key rules are duplicated: the model/prompt-migration exception is restated in "When To Use", "Coordination With Implementation Skills", and "Mandatory First Step"; the reuse-vs-new question appears in "Mandatory First Step", "Credential Decision Messages", and Workflow step 2; and "prefer ignored or untracked env files" repeats in Safety Rules and Workflow step 1. This is more than anchor 4's "minor instances of over-explanation", so anchor 3 ("mostly efficient but... could be tightened") is the best fit, while clearly above anchor 2's padded verbosity.

3 / 5

Actionability

Guidance is fully executable: exact tool contracts ("call `open_codex_api_key_setup` directly with no arguments (`{}`)", connector id `connector_2de447f3f15448ebab48783d7e4f5d81`), a verbatim user-facing fallback question ("Save the new key to <path>? Reply yes to continue, another workspace-relative env-file path to change it, or decline."), and complete copy-paste-ready `prepare`/`decrypt` bash commands. This matches anchor 5 ("fully executable; copy-paste ready; covers the common cases") across picker, text-only fallback, and tracked-target branches.

5 / 5

Workflow Clarity

The multi-step flow has explicit validation checkpoints and hard stops ("Stop until the user answers", "end the current turn immediately and wait for the widget-generated follow-up prompt"), error-recovery feedback loops ("if unavailable or auth fails, ask the user to connect OpenAI Platform from `/apps`... then retry `tool_search`"; "If it is declined or canceled, stop"), a checklist-style Mandatory First Step, destination confirmation and tracked-target checks before any secret write, and a final verify step. This matches anchor 5 ("explicit validation steps; feedback loops for error recovery; checklists"); the destructive/batch cap does not apply because validation is present throughout.

5 / 5

Progressive Disclosure

The single reference is clearly signaled, one level deep, and real ("`references/evals.md`: trigger and routing eval cases for this skill" — verified to exist and match its description), and the body is well-sectioned with descriptive headers. It sits at anchor 4 rather than 5 because all detailed branch-handling policy (picker sub-procedure, exact message wording, connector retry logic) remains inline in a ~140-line body rather than being split out, a minor organization gap.

4 / 5

Total

17

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly covers both what the skill does and when to use it, with concrete trigger phrases ("using AI", forms-driven generators), exact identifiers (OPENAI_API_KEY, sk-proj), and explicit negative boundaries. Its main costs are density from packing gating policy into three long sentences and slight overlap risk from the provider-unspecified scope.

DimensionReasoningScore

Specificity

Lists several concrete actions ("inspect safely, ask reuse-vs-new before API work", "never expose plaintext", "OPENAI_API_KEY or sk-proj setup") alongside concrete trigger verbs ("build, run, test, debug, or configure"). It sits at anchor 4 rather than 5 because "treat this as the credential gate" is procedural framing rather than a concrete action, leaving minor coverage gaps in what the skill itself does.

4 / 5

Completeness

Explicitly answers both what ("credential gate: inspect safely, ask reuse-vs-new before API work, and never expose plaintext") and when ("Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app... especially requests phrased only as 'using AI'"), with concrete trigger phrases and an explicit anti-trigger for migrations. This matches the anchor-5 pattern of concrete what-plus-when with trigger phrases.

5 / 5

Trigger Term Quality

Includes natural user phrasing ("using AI", "generators driven by forms/user input", "AI app, UI, script, CLI, generator, or tool") plus the exact env-var name and key prefix ("OPENAI_API_KEY", "sk-proj"). A few natural synonyms are missing (e.g., "GPT", "chatbot", ".env"), so it matches anchor 4 rather than 5's comprehensive synonym coverage, and is well above anchor 3's partial keyword set.

4 / 5

Distinctiveness Conflict Risk

OpenAI-specific tokens ("sk-proj", "OPENAI_API_KEY") and the migration carve-out ("Do not gate model or prompt migrations...") establish a clear niche, but the "provider-unspecified" scope creates minor overlap risk with other provider-credential skills. Anchor 4 ("mostly distinct; minor overlap risk") fits better than 5's minimal conflict risk.

4 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

openai/plugins

Path

plugins/openai-developers/skills/openai-platform-api-key/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.