codex: update model/effort and refresh system skills

.codex/skills/.system/skill-installer/scripts/install-skill-from-github.py

@@ -15,6 +15,7 @@ import urllib.parse
 import zipfile
 
 from github_utils import github_request
+
 DEFAULT_REF = "main"
 
 
@@ -97,7 +98,9 @@ def _download_repo_zip(owner: str, repo: str, ref: str, dest_dir: str) -> str:
 
 
 def _run_git(args: list[str]) -> None:
-    result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    result = subprocess.run(
+        args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
+    )
     if result.returncode != 0:
         raise InstallError(result.stderr.strip() or "Git command failed.")
 
@@ -125,7 +128,9 @@ def _validate_skill_name(name: str) -> None:
         raise InstallError("Invalid skill name.")
 
 
-def _git_sparse_checkout(repo_url: str, ref: str, paths: list[str], dest_dir: str) -> str:
+def _git_sparse_checkout(
+    repo_url: str, ref: str, paths: list[str], dest_dir: str
+) -> str:
     repo_dir = os.path.join(dest_dir, "repo")
     clone_cmd = [
         "git",
@@ -161,13 +166,55 @@ def _git_sparse_checkout(repo_url: str, ref: str, paths: list[str], dest_dir: st
     return repo_dir
 
 
-def _validate_skill(path: str) -> None:
+def _validate_skill(path: str, repo_root: str) -> None:
+    resolved_repo_root = os.path.realpath(repo_root)
+    resolved_path = os.path.realpath(path)
+    try:
+        inside_repo = (
+            os.path.commonpath([resolved_repo_root, resolved_path])
+            == resolved_repo_root
+        )
+    except ValueError:
+        inside_repo = False
+    if not inside_repo:
+        raise InstallError("Skill path must be inside the repo.")
+
+    relative_path = os.path.relpath(path, repo_root)
+    current_path = repo_root
+    for component in relative_path.split(os.path.sep):
+        current_path = os.path.join(current_path, component)
+        if os.path.islink(current_path):
+            raise InstallError(
+                f"Symbolic links are not allowed in skills: {os.path.relpath(current_path, repo_root)}"
+            )
+
     if not os.path.isdir(path):
         raise InstallError(f"Skill path not found: {path}")
     skill_md = os.path.join(path, "SKILL.md")
     if not os.path.isfile(skill_md):
         raise InstallError("SKILL.md not found in selected skill directory.")
 
+    for root, directories, files in os.walk(path):
+        for name in directories + files:
+            entry_path = os.path.join(root, name)
+            relative_entry = os.path.relpath(entry_path, repo_root)
+            if os.path.islink(entry_path):
+                resolved_entry = os.path.realpath(entry_path)
+                try:
+                    inside_skill = (
+                        os.path.commonpath([resolved_path, resolved_entry])
+                        == resolved_path
+                    )
+                except ValueError:
+                    inside_skill = False
+                if not inside_skill or not os.path.isfile(resolved_entry):
+                    raise InstallError(
+                        f"Unsupported symbolic link in skill: {relative_entry}"
+                    )
+                continue
+            if not os.path.isdir(entry_path) and not os.path.isfile(entry_path):
+                raise InstallError(f"Unsupported file type in skill: {relative_entry}")
+
 
 def _copy_skill(src: str, dest_dir: str) -> None:
     os.makedirs(os.path.dirname(dest_dir), exist_ok=True)
@@ -290,7 +337,7 @@ def main(argv: list[str]) -> int:
                 if os.path.exists(dest_dir):
                     raise InstallError(f"Destination already exists: {dest_dir}")
                 skill_src = os.path.join(repo_root, path)
-                _validate_skill(skill_src)
+                _validate_skill(skill_src, repo_root)
                 _copy_skill(skill_src, dest_dir)
                 installed.append((skill_name, dest_dir))
         finally:

.codex/skills/.system/skill-installer/scripts/list-skills.py

@@ -54,8 +54,7 @@ def _list_skills(repo: str, path: str, ref: str) -> list[str]:
     except urllib.error.HTTPError as exc:
         if exc.code == 404:
             raise ListError(
-                "Skills path not found: "
-                f"https://github.com/{repo}/tree/{ref}/{path}"
+                f"Skills path not found: https://github.com/{repo}/tree/{ref}/{path}"
             ) from exc
         raise ListError(f"Failed to fetch skills: HTTP {exc.code}") from exc
     data = json.loads(payload.decode("utf-8"))