trending/plugins
1
0
Fork 0
mirror of https://github.com/openai/plugins.git synced 2026-10-02 04:04:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

Keep offline model migrations independent of credentials

Browse Source
This commit is contained in:
Konstantine Kahadze
2026-07-13 13:34:20 -07:00
parent 11c74d6ba2
commit c33bd6902e
3 changed files with 20 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/openai-developers/skills/openai-platform-api-key/SKILL.md
+5 -5
View File
@@ -1,6 +1,6 @@
---
name: openai-platform-api-key
description: 'Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool, especially requests phrased only as "using AI" or generators driven by forms/user input; also use for OPENAI_API_KEY or sk-proj setup. Treat this as the credential gate: inspect safely, ask reuse-vs-new before API work, and never expose plaintext.'
description: 'Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool that needs live API access, especially requests phrased only as "using AI" or generators driven by forms/user input; also use for OPENAI_API_KEY or sk-proj setup. Do not gate model or prompt migrations that can proceed with source edits and offline validation. Treat this as the credential gate before live API work: inspect safely, ask reuse-vs-new, and never expose plaintext.'
---
# OpenAI API Key
@@ -25,12 +25,13 @@ Do not use it when:
- The user asks for a static frontend, visual mockup, design concept, or placeholder UI with no API-backed behavior.
- The user only asks Codex to write a one-off output directly and no app, script, generator, or API-backed tool is being built or run.
- The user names a different AI provider for the artifact.
- The user asks to migrate or update an existing OpenAI model or prompts and the work can proceed through source or configuration edits plus offline, mocked, static, fixture-based, or syntax validation. Use this skill later only if a live API request is actually needed.
If API access is needed and no usable key is found, offer secure key provisioning instead of leaving only placeholder docs or manual setup steps.
## Coordination With Implementation Skills
When another implementation skill also applies, run this skill first only to inspect credentials safely and send the credential decision message. Until reuse-existing-key vs create-new-key is resolved, it outranks design-first and implementation-first flows, including `build-web-apps:frontend-app-builder`; do not design UI, choose architecture, inspect API examples, write code, or run smoke tests. After the user answers, hand off to the appropriate implementation, docs, or frontend skill.
When another implementation skill also applies and the request adds API-backed functionality or requires a live API call, run this skill first only to inspect credentials safely and send the credential decision message. Until reuse-existing-key vs create-new-key is resolved, it outranks design-first and implementation-first flows, including `build-web-apps:frontend-app-builder`; do not design UI, choose architecture, inspect API examples, write code, or run smoke tests. Model and prompt migrations are the exception above: complete requested source/configuration edits and offline validation without a credential decision, then use this skill only before any live API request. After the user answers, hand off to the appropriate implementation, docs, or frontend skill.
## Safety Rules
@@ -49,7 +50,7 @@ When another implementation skill also applies, run this skill first only to ins
## Mandatory First Step
Before editing, testing, running, debugging, or configuring any code that calls the OpenAI API:
Before adding new API-backed functionality, changing API-backed behavior beyond the model/prompt migration exception above, or making a live OpenAI API request:
1. Inspect for a usable `OPENAI_API_KEY` without printing it.
2. Unless the user explicitly asked for a new key, ask whether to reuse an existing key or create a new one. If none exists, ask whether to create one.
@@ -58,13 +59,12 @@ Before editing, testing, running, debugging, or configuring any code that calls
This applies even if:
- a usable key already exists
- no live API call will be made
- no secret will be written
- the task is "just create a script"
Finding an existing key is not permission to proceed. It only changes the question you ask.
The credential decision is a hard stop. Before the user answers, do not create directories, scaffold files, draft implementation plans, wire API-dependent code, run smoke tests, or give placeholder/manual key setup instructions. The only allowed pre-gate work is safe repo convention discovery and credential presence checks that do not print secrets.
The credential decision is a hard stop for new API-backed functionality and live API requests. Before the user answers, do not create directories, scaffold files, draft implementation plans, wire API-dependent code, run smoke tests, or give placeholder/manual key setup instructions. It does not block the model/prompt migration exception above. The only allowed pre-gate work is safe repo convention discovery and credential presence checks that do not print secrets.
## Credential Decision Messages
plugins/openai-developers/skills/openai-platform-api-key/references/evals.md
+1
View File
@@ -22,6 +22,7 @@ Use this matrix to test implicit activation and the key-flow handoff for
- "Write a poem about New York City." (no API access required)
- "Build a script that uses Claude to summarize files." (different provider)
- "Build a Gemini-powered UI for image prompts." (different provider)
- "Migrate this existing app to the latest OpenAI model and update its prompts." (`openai-docs`; source edits and offline validation do not require credentials)
## 2. Routing tests
plugins/openai-developers/tests/openai-platform-api-key.test.mjs
+14 -6
View File
@@ -317,7 +317,7 @@ test("skill asks before building API-backed apps when any usable key exists", ()
assert.match(
description,
/Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool/,
/Use when Codex is asked to build, run, test, debug, or configure an OpenAI-backed or provider-unspecified AI app, UI, script, CLI, generator, or tool that needs live API access/,
);
assert.match(
description,
@@ -329,7 +329,11 @@ test("skill asks before building API-backed apps when any usable key exists", ()
);
assert.match(
description,
/Treat this as the credential gate: inspect safely, ask reuse-vs-new before API work/,
/Do not gate model or prompt migrations that can proceed with source edits and offline validation/,
);
assert.match(
description,
/Treat this as the credential gate before live API work: inspect safely, ask reuse-vs-new/,
);
assert.match(
skill,
@@ -369,7 +373,7 @@ test("skill asks before building API-backed apps when any usable key exists", ()
);
assert.match(
skill,
/When another implementation skill also applies, run this skill first only to inspect\s+credentials safely and send the credential decision message\./,
/When another implementation skill also applies and the request adds API-backed\s+functionality or requires a live API call, run this skill first only to inspect\s+credentials safely and send the credential decision message\./,
);
assert.match(
skill,
@@ -432,11 +436,11 @@ test("skill makes the key-choice gate impossible to miss", () => {
assert.match(skill, /## Mandatory First Step/);
assert.match(
skill,
/Before editing, testing, running, debugging, or configuring any code that calls\s+the OpenAI API:\s+1\. Inspect for a usable `OPENAI_API_KEY` without printing it\.\s+2\. Unless the user explicitly asked for a new key, ask whether to reuse an\s+existing key or create a new one\. If none exists, ask whether to create one\.\s+3\. Stop until the user answers\./,
/Before adding new API-backed functionality, changing API-backed behavior beyond\s+the model\/prompt migration exception above, or making a live OpenAI API request:\s+1\. Inspect for a usable `OPENAI_API_KEY` without printing it\.\s+2\. Unless the user explicitly asked for a new key, ask whether to reuse an\s+existing key or create a new one\. If none exists, ask whether to create one\.\s+3\. Stop until the user answers\./,
);
assert.match(
skill,
/This applies even if:\s+- a usable key already exists\s+- no live API call will be made\s+- no secret will be written\s+- the task is "just create a script"/,
/This applies even if:\s+- a usable key already exists\s+- no secret will be written\s+- the task is "just create a script"/,
);
assert.match(
skill,
@@ -444,7 +448,7 @@ test("skill makes the key-choice gate impossible to miss", () => {
);
assert.match(
skill,
/The credential decision is a hard stop\. Before the user answers, do not create\s+directories, scaffold files, draft implementation plans, wire API-dependent\s+code, run smoke tests, or give placeholder\/manual key setup instructions\./,
/The credential decision is a hard stop for new API-backed functionality and live\s+API requests\. Before the user answers, do not create directories, scaffold files,\s+draft implementation plans, wire API-dependent code, run smoke tests, or give\s+placeholder\/manual key setup instructions\. It does not block the model\/prompt\s+migration exception above\./,
);
assert.match(
skill,
@@ -573,6 +577,10 @@ test("eval matrix includes local picker boundary and two-field joke app use case
evals,
/if the rollout proceeds after a confirmed key decision, the app plan or implementation\s+should collect two user input fields and send both fields into the AI joke-generation request/,
);
assert.match(
evals,
/Migrate this existing app to the latest OpenAI model and update its prompts\./,
);
});
test("openai-docs defers to API key skill for implementation tasks", (t) => {