package-installer

package-installer is a skill for Claude Code, Codex from Orkas-AI/Orkas. It costs 3 tokens per session (1,222 once invoked), scanned A, original, MIT.

A guide for installing an open-source project from a GitHub address or local Git folder as an external package.

In plain words
What is it for?
Use it to install, update, remove, list, or inspect third-party packages.
Why use it?
It keeps the installed project unchanged and makes dependency approval, updates, removal, and inspection explicit.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to install, update, remove, list, or inspect third-party packages.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/orkas-ai/orkas/package-installer
About the project

Orkas is a desktop application for commanding a team of AI agents through one chat, with a commander model assigning work to specialist agents in parallel or in sequence. People use it to coordinate research, writing, presentations, and software tasks while keeping files on their computer. The catalogue includes skills for extending the agents available to Orkas.

Orkas-AI/Orkas · 1,808 stars · on GitHub · orkas.ai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Orkas-AI/Orkas --skill package-installer
Clone the repo
git clone --depth 1 https://github.com/Orkas-AI/Orkas

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for package-installer

README.md
[![agentmods](https://agentmods.dev/badge/skills/orkas-ai/orkas/package-installer/github.svg)](https://agentmods.dev/skills/orkas-ai/orkas/package-installer)
Your own site
<a href="https://agentmods.dev/skills/orkas-ai/orkas/package-installer"><img src="https://agentmods.dev/badge/skills/orkas-ai/orkas/package-installer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for package-installer

Your own site · 80×15
<a href="https://agentmods.dev/skills/orkas-ai/orkas/package-installer"><img src="https://agentmods.dev/badge/skills/orkas-ai/orkas/package-installer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 3 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,222 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00003 $0.01222
Opus 5 $0.00002 $0.00611
Sonnet 5 $0.00001 $0.00244
Haiku 4.5 $0.00000 $0.00122

Measured 5d ago against content hash 99a02f6341bd, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

package-installer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

resources/builtin/system/skills/package-installer/SKILL.md · 102 lines

How it starts

The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Package Installer

Install third-party open-source projects (a GitHub URL or a local git directory the user provides) as external packages. The project is cloned verbatim into the per-user packages directory — never edit, normalize, or reorganize its files.

Run the Orkas CLI command below through the command execution tool; Orkas handles this runner form directly on Windows:

"$ORKAS_NODE" "$ORKAS_PC_DIR/bin/orkas-pkg.cjs" <command> [args]

Commands: install <git-url> [--name <name>] [--consent-deps], consent-deps <name>, update <name>, remove <name>, list, info <name>. Every command prints a JSON result; non-zero exit prints {ok:false,error}.

Install flow

  1. Run install <git-url>. Use --name <name> when the user, marketplace prompt, or install request explicitly gives a package name, or when the repo basename is not a valid package name (the error message will say so). Never pass --consent-deps on the first attempt — dependency installs need the user's explicit approval first.
  2. Read the JSON result:
    • deps_pending_consent non-empty → the package is installed but its dependencies are not. Show the user the exact commands listed there and ask for approval; after they agree, run consent-deps <name>. If they decline, leave it as is — skills that need no deps still work.
    • error mentioning "not installable" → tell the user the project has neither skills (SKILL.md) nor CLI entry points and is not supported (agent-driven-only projects cannot be installed).
  3. Report what was installed, from the result fields:
    • skill_roots non-empty → its skills become available in new turns.
    • shims non-empty → those commands are directly callable from the host shell/PATH in the next turn (e.g. hyperframes --help). On Windows the installer creates .cmd shims for CLI entries.

Author a usage skill for CLI-only installs

When the install result is kind: "cli" (empty skill_roots, non-empty bin_entries), author a companion usage skill so future turns get curated instructions instead of a bare command list. Do this automatically right after a successful CLI install — the user already approved installing it. Skip for kind: "skill" and kind: "both" (they already ship their own SKILL.md).

Read the full file on GitHub · 102 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 102 lines · 3 tokens per session scan A 99a02f6341bd

Subscribe to this mod's changes

package-installer is a skill published in the GitHub repository Orkas-AI/Orkas (1,808 stars, last pushed yesterday), licensed MIT. It adds 3 tokens to every session and 1,222 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

tutti-workspace-app-factory

Create, convert, or repair one Tutti workspace app as either a self-contained publishable package under package/ or a Chrome-style local debug app under .tutti/dev-app/. Use for mention://workspace-app-factory/create handoffs, mention://workspace-app-factory handoffs, standalone app generation, adapting existing…

tutti-os/tutti · 138 tokens

tutti-ui-system

Use when working with @tutti-os/ui-system components, replacing local UI with shared components, querying component ids or metadata, promoting UI into shared base or business components, or maintaining UI-system storyboard inventory.

tutti-os/tutti · 46 tokens

tutti-agent-workspace-app

Build or evolve a complex agent-enabled Tutti workspace app repository. Use for Tutti apps with web/server/shared monorepos, @tutti-os/agent-acp-kit local agent runtimes, kit-owned TUTTICLI agent/composer discovery, dynamic agent catalogs, run-scoped MCP tool gateways, app-owned package builders, web-first debugging…

tutti-os/tutti · 106 tokens

takt

A workflow engine that runs a task through a sequence of steps defined in a YAML file, using separate coding agents for the work.

nrslib/takt · 63 tokens

takt

A workflow engine for coordinating multiple coding agents. It reads a YAML workflow, a text configuration format, and moves agents through its defined steps and rules.

nrslib/takt · 60 tokens

create-coordclaw-team

A Skill for creating a CoordClaw multi-agent collaborative team. Through an 8-step standardized process, from requirement gathering to team validation, rapidly build a complete AI team.

CoordClaw/CoordClaw · 42 tokens