How to install Codex Skills without exposing a key or wasting API credit

To install Codex Skills from xplaai, choose a Commerce Skill, use the package offered for Codex on that Skill page, give the archive to Codex and ask it to report the actual install path. Codex should read the included SKILL.md, run the package-specific doctor or environment check, confirm only whether the xplaai key is configured, and stop after a dry-run until you approve paid tasks.

Choose a Commerce Skill or create an xplaai API key.

Before you install

Prepare:

• a working Codex environment on your computer;
• an xplaai account;
• the source files or brief required by the selected Skill;
• a local project folder for generated results;
• permission to download the Skill if its detail page requires membership.

Do not download a ZIP from a copied storage URL or an unverified mirror. Public case media and private installation packages are different assets.

Step 1: verify what the selected Skill actually distributes

Open the selected Skill detail page. If the page offers an Agent selector, choose Codex and download through the normal account flow. If the page offers one shared archive, use that documented archive instead of inventing a second package.

xplaai's current publishing standard uses separate Codex and WorkBuddy packages for newly verified dual-Agent releases. A concrete example is dog-video-auto-edit, which has distinct Codex and WorkBuddy artifacts. The free Product Video workflow is a current exception: its release source contains one shared xpla-video-gen ZIP. Package shape is therefore a Skill-level fact, not a site-wide promise.

When separate packages exist, do not rename a WorkBuddy ZIP and assume it now has the Codex format. The source version may be shared, but the frontmatter, manager metadata and installer target can differ.

Access varies by Skill. Some workflows can be free while others require an active Commerce membership. xplaai API usage remains separate from package access.

Step 2: give the ZIP to Codex

Attach or point Codex to the downloaded ZIP and use an instruction like:

Install this xplaai Commerce Skill locally.
When installation is complete, report the installed path,
identify the Skill name and version, and do not run paid API calls yet.

The package may be installed in a user-level or project-level Skill directory. Let Codex report the actual path instead of assuming one fixed folder on every machine.

Keep the original ZIP until the environment check succeeds. This gives you a known package to reinstall if an extraction step was interrupted.

Codex Skill folders: official convention versus package-specific installer

The current official OpenAI documentation describes a Skill as a folder with a required SKILL.md and optional scripts/, references/ and assets/. It documents global Skills under ~/.agents/skills and repository Skills under .agents/skills.

An xplaai package can still include a verified installer for another supported Codex location. For example, the current dog-video-auto-edit installer targets:

~/.codex/skills/dog-video-auto-edit/

and runs:

python3 scripts/install_skill.py --target codex

This is why a useful installation guide does not tell every reader to copy every ZIP into one hard-coded directory. Use the current package instructions, then ask Codex to report the path and confirm that SKILL.md exists there. For a repository-wide team workflow, check whether the package explicitly supports a repo-scoped install before placing files in the project.

Step 3: run the Skill's doctor check

Ask Codex to read the installed SKILL.md and run the environment or doctor command included by that package.

Read the installed Skill instructions and run its doctor check.
Report missing tools, configuration and source files.
Do not read or print any secret values.

Doctor commands are package-specific. Some Skills use an offline flag or additional setup script; others use a simpler check. The selected package is the source of truth.

The result should clearly separate:

• installed and available tools;
• missing dependencies;
• optional tools;
• missing local configuration;
• whether the Skill is ready for a dry-run.

Step 4: create and configure one xplaai key

Create a key in the xplaai token console. Grant only the access needed by the workflow.

Configure it using the local method described by the Skill. Do not:

• paste it into this article;
• add it to the ZIP;
• commit it to Git;
• place it in browser code;
• include it in screenshots or support messages;
• ask Codex to echo the full value back.

After configuration, ask Codex to confirm only whether the key is present—not to reveal it.

Step 5: run a dry-run before execution

Provide the input material and request a plan without paid generation:

Use the installed Skill with the source material in this project.
First run a dry-run. Report the planned steps, expected image,
speech, video or data task count, estimated xplaai API credit,
output paths and anything requiring approval.
Wait for my confirmation before paid API calls.

Review the plan for:

• the right source files;
• the expected number of generated assets;
• the selected models or data operations;
• editable versus final deliverables;
• output locations;
• work that can be resumed after a failure.

Approve execution explicitly only after the plan matches your intent.

Verified example: install and inspect dog-video-auto-edit

The pet-video Skill provides a concrete, source-backed example of the complete sequence. Its current package includes SKILL.md, installation notes and three relevant scripts:

The verified minimum for this example is Python 3.9 or later. FFmpeg is needed for media inspection and final assembly. The doctor can still report dry-run readiness separately from live-generation readiness. These requirements belong to this Skill only; a research or product-video Skill may use Node.js, a different doctor command or no installer script.

Use this first instruction after installation:

Read the installed SKILL.md and installation notes completely.
Run only the documented doctor or offline environment check.
Report:
1. the exact installed path and Skill name;
2. required and optional dependencies;
3. whether XPLA_API_KEY is configured, without showing it;
4. the supported dry-run command;
5. every step that can call a paid API.
Do not install unrelated global software and do not run a live task.

Verify the first result

After execution, ask Codex for a completion report:

• which steps succeeded;
• which steps failed or were skipped;
• the paths to generated files;
• the public xplaai model names used;
• remaining manual review;
• whether the project can resume from the failed step.

Open the deliverables yourself. Review product claims, logos, likenesses, rights, captions and platform-specific requirements before publishing.

For workflow-specific examples, continue with the Commerce Skills tutorials. If you are building your own integration around the same services, review the xplaai API overview.

Troubleshooting

Skill not detected

Confirm that you downloaded the Codex package. Ask Codex to report the extraction path, list the installed Skill name and rerun the package-specific doctor.

Invalid API key

Create a new key, remove accidental whitespace and configure it locally. Do not paste the full value into a public message.

Missing dependency

Use the doctor output to identify the exact tool. Follow the package instructions instead of installing unrelated dependencies globally.

Insufficient account capacity

Review the current account state in the xplaai console. Keep the run paused until you understand the expected task count.

Interrupted generation

Ask Codex to report completed and failed steps. Where the Skill supports resumable execution, continue only from the failed step instead of repeating successful paid work.

Skill update available

Download the current Codex ZIP from the Skill detail page, ask Codex to update the installation and rerun the doctor check. Keep local secrets outside the package.

Frequently asked questions

Can I use the WorkBuddy ZIP in Codex?

If the Skill page offers separate Agent packages, use the Codex artifact. If it offers one documented shared package, follow that package. Never create compatibility by renaming a ZIP.

Where does Codex install the Skill?

OpenAI's current general convention includes ~/.agents/skills for global Skills and .agents/skills for repository Skills. A verified xplaai installer may use a supported package-specific path such as ~/.codex/skills/<skill-name>. Ask Codex to report the actual path.

What doctor command should I run?

Run the command documented by the selected Skill package. There is no safe universal command for every Commerce Skill.

Where should I store the xplaai key?

Use the local configuration method in the Skill instructions. Never put the key in the ZIP, Git, browser code or public logs.

How do I avoid unexpected API usage?

Request a dry-run that reports task counts and expected API credit. Approve paid execution only after reviewing the plan.

What if the Skill is installed but the first task fails?

Ask Codex for completed and failed steps, fix the reported issue and resume only the failed portion where supported.

Is installing a Skill the same as installing a Codex plugin?

No. A Skill is the reusable workflow folder that contains SKILL.md and optional resources. Current OpenAI documentation describes plugins as the installable distribution unit when a workflow is bundled for broader discovery or connectors. xplaai Commerce Skill ZIPs in this guide are local workflow packages.

Does a free Skill ZIP make image or video generation free?

No. Package access and xplaai API usage are separate. A free ZIP can still call paid data, speech, image or video services after you approve a live run.

Choose your first Codex Skill

Browse xplaai Commerce Skills, open a real case, download the Codex package and complete the doctor check before running paid tasks.