gem-hunter
Language: Go
Every API has a secret identity. This finds it, absorbs every feature from every competing tool, then builds the GOAT CLI — designed for AI agents first, with SQLite sync, offline search, and compound insight commands.
Nothing is more valuable than time and money. In a world of AI agents, that's speed and token spend. A well-designed CLI is muscle memory for an agent: no hunting through docs, no wrong turns, no wasted tokens. We built the Printing Press to print the best CLIs in the world for agents.
It reads the official API docs, studies every popular community CLI and MCP server, sniffs the web for the APIs nobody published (think Google Flights or Dominos), and applies the power-user playbook Peter Steinberger proved with discrawl and gogcli - local SQLite, compound commands, agent-native flags. It fuses all of that and prints a token-efficient Go CLI plus a Claude Code skill plus an MCP server for any API or any website.
Three CLIs printed by the press, installable today:
Browse the full catalog of printed CLIs at printingpress.dev or in the Printing Press Library, organized by category, most with full MCP servers.
Codex users: see docs/CODEX.md to install the Printing Press skills with --agent codex, verify the install, and understand how that differs from /printing-press <api> codex.
Cursor users: see docs/CURSOR.md for how to install a printed CLI, attach the matching skill, handle auth, and choose CLI vs MCP when your repo does not already document a workflow.
You need both the binary and the Printing Press skills. The skills (/printing-press <app>) are the primary interface; they drive the binary behind the scenes.
The binary alone works (research, generation, verification, scoring) but skips the curated agent loop. The skills alone have nothing to call. Install both.
Prerequisites: Go 1.26.10 or newer, Claude Code or another skills-supported agent, and Node/npm for npx. The skills are tested with Claude Code; install for Codex with --agent codex when you want to try the same slash-command workflow there. Use Claude Code for the best-tested experience.
curl -fsSL https://raw.githubusercontent.com/mvanhorn/cli-printing-press/main/scripts/install.sh | bashThe installer runs go install for the generator binary, then refreshes all Printing Press skills through skills@latest add --skill '*'. Restart or reload your agent session after it completes so the refreshed skills are loaded.
Use --cli-only or --skills-only when you only want one side:
curl -fsSL https://raw.githubusercontent.com/mvanhorn/cli-printing-press/main/scripts/install.sh | bash -s -- --cli-only curl -fsSL https://raw.githubusercontent.com/mvanhorn/cli-printing-press/main/scripts/install.sh | bash -s -- --skills-only
Claude Code is the default install target. To install or refresh the skills for Codex instead, pass --agent codex:
curl -fsSL https://raw.githubusercontent.com/mvanhorn/cli-printing-press/main/scripts/install.sh | bash -s -- --skills-only --agent codex
npx -y skills@latest list -g -a codex --jsonSee docs/CODEX.md for the Codex-specific notes.
Verify with cli-printing-press --version. If install fails, confirm Go 1.26.10 or newer is installed, Node/npm is installed for npx, and $GOPATH/bin is on your PATH.
Older releases installed a generator binary named printing-press. That legacy
entrypoint still works for compatibility, but the canonical generator command is
now cli-printing-press so the public library installer can own
printing-press list, printing-press search, and printing-press install.
Install or update the binary:
go install github.com/mvanhorn/cli-printing-press/v4/cmd/cli-printing-press@latest
Use Vercel's open-agent-skills CLI to install the Printing Press skills from this repo into a supported agent. Claude Code is the default and tested path:
npx -y skills@latest add mvanhorn/cli-printing-press/skills --skill '*' -g -a claude-code -yFor Codex:
npx -y skills@latest add mvanhorn/cli-printing-press/skills --skill '*' -g -a codex -y
npx -y skills@latest list -g -a codex --jsonTo refresh the skills later without naming individual skills, rerun the installer in skills-only mode:
curl -fsSL https://raw.githubusercontent.com/mvanhorn/cli-printing-press/main/scripts/install.sh | bash -s -- --skills-onlyRestart or reload the target agent after refreshing skills so the new skill text is loaded.
Once installed, you can start Claude Code from any folder. Codex users should start a fresh Codex session after installing or refreshing skills.
Developer path: load skills from a cloneUse this if you're editing the Printing Press itself and want local skill changes to take effect on the next session start.
git clone https://github.com/mvanhorn/cli-printing-press.git cd cli-printing-press claude --plugin-dir . # load this repo's skills directly claude --plugin-dir . -w # ...in a new git worktree (parallel runs)
For a persistent local setup that survives restarts and also loads in background sessions, see Local Plugin Development.
claude
Then inside Claude Code:
/printing-press <app-name>
For example:
/printing-press Notion # Print a CLI for an API by name
/printing-press https://postman.com/explore # ...or point at a website (no spec needed)
/printing-press-reprint notion # Reprint an existing CLI under the latest machine
/printing-press drives the cli-printing-press binary you installed — research, generation, scoring, and shipcheck all run through it. Two parts, one workflow.
One command. Lean loop. Produces a Go CLI plus an MCP server that absorbs every feature from every competing tool, then transcends with compound use cases only possible with local data. REST, GraphQL, or browser-sniffed traffic. No OpenAPI spec required.
Each run produces two binaries (<api>-pp-cli plus <api>-pp-mcp), research documents, verification proofs, and a Quality Score.
By default, active and published output are separated:
~/printing-press/.runstate/<scope>/runs/<run-id>/working/<api>-pp-cli~/printing-press/library/<api>~/printing-press/manuscripts/<api>/<run-id>/research/, proofs/, discovery/, and pipeline/<scope> is derived from the current git checkout path, so parallel worktrees do not stomp on each other. If you pass --output, that overrides the generated CLI location for that command.
/printing-press HubSpot codex # Offload code generation to Codex CLI /printing-press HubSpot # Standard Opus mode (default)
When you add codex, Phase 3's code generation tasks are delegated to Codex CLI. Claude stays the brain (research, planning, scoring, review). Codex does the hands (writing Go code from scoped prompts). Same quality, 60% fewer Opus tokens. If Codex fails 3 times in a row, the press falls back to doing it locally, no manual intervention needed.
Targeted fix-up. Diagnostics (dogfood, verify, scorecard, output review), fixes verify failures, removes dead code, cleans descriptions and READMEs, offers to publish. Auto-runs as Phase 5.5 of every generation; can also run standalone:
/printing-press-polish notion
When you're happy with a CLI, publish it to the library:
/printing-press-publish linear # Validates, packages, creates PRAfter dogfooding a published CLI in a Claude Code session, turn the friction you hit (missing flags, hand-rolled API payloads, silent-null returns) into a PR for the public library. Mines the active session transcript, scopes the patch with you, plans + executes the fix autonomously, scrubs PII, and opens a PR — two checkpoints (scope, PR draft):
/printing-press-amend # auto-detect target CLI from session /printing-press-amend superhuman # explicit target
Most generators wrap endpoints and stop. Printing Press generates CLIs that understand the domain.
Local-first data layer. High-gravity resources get domain-specific SQLite tables (not JSON blobs), FTS5 full-text search indexes, and incremental sync with cursor tracking. sync pulls data down. search finds it in milliseconds. sql lets power users query directly. All offline, all local.
Machine-owned freshness. Store-backed CLIs can opt into a bounded pre-read refresh via cache.enabled so --data-source auto keeps the local store current without a manual sync. --data-source local and --data-source live give you full control.
Compound commands no wrapper can do. Once data lives in SQLite, commands like stale, health, bottleneck, and reconcile become possible - they join across resources and analyze history. A stateless API wrapper literally cannot do this.
Agent-native by default. Human-friendly tables when you're in a terminal. Auto-JSON when piped, no --json flag needed. --compact drops to high-gravity fields only (60-80% fewer tokens). Typed exit codes (0/2/3/4/5/7) let agents self-correct without parsing error text. --dry-run for safe exploration. Every flag exists because an AI agent will call it thousands of times a day.
No spec? No problem. Don't have an OpenAPI spec? Point the press at a website. It launches a browser, captures traffic, reverse-engineers the API, and generates the spec for you. ESPN, Postman Explore, internal tools - if you can click through it, the press can build a CLI for it.
Dual interface from one spec. Every API gets a Cobra CLI (<api>-pp-cli) and an MCP server (<api>-pp-mcp). Same client, same store, same auth. Shell agents use the CLI. IDE agents use MCP. Zero code duplication.
Verified, not vibes. Four mechanical checks - scorecard, dogfood, proof-of-behavior, live API smoke test - catch hallucinated paths, dead flags, auth mismatches, and broken data pipelines before you ship.
Credits its sources. Every generated README includes a Sources and Inspiration section that credits the ecosystem tools studied during research. We built on giants' shoulders and we say so.
Every API has a secret identity. The data it exposes is useful for something its creators never designed for. The printing press finds that secret and builds a CLI around it.
The Non-Obvious Insight (NOI) is a one-sentence reframe:
"[API] isn't just [obvious thing]. It's [non-obvious thing].
Every [data point] is a signal about [hidden truth]."
| API | What they think it is | What it actually is |
|---|---|---|
| Discord | A chat app | A searchable knowledge base. Every message thread is institutional memory. |
| Linear | An issue tracker | A team behavior observatory. Every state change is a signal about how your team actually works vs. how they think they work. |
| Stripe | A payment processor | A business health monitor. Every failed charge and churn event is a signal about product-market fit. |
| GitHub | A code host | An engineering culture fingerprint. Every review turnaround and merge pattern is a signal about how your team ships. |
| Notion | A doc editor | A knowledge decay detector. Every stale page and orphaned database is a signal about what your team has forgotten. |
| HubSpot | A CRM | Your company's relationship memory. Every deal stage transition, email open, and meeting log is a signal about pipeline health and rep performance. |
| Slack | Messaging | An organizational nervous system. Every response time and channel silence is a signal about team health. |
| ESPN | Sports data | A betting intelligence terminal. Every injury report, lineup change, and odds movement is a signal about game outcomes. |
The NOI is the creative DNA of every CLI the press generates. Phase 0 cannot complete without one. If the LLM can't write an NOI, the research wasn't deep enough.
The printing press automates what Steinberger does intuitively: look at an API, see what power users actually do with it, and build the commands that matter. Then also wrap every endpoint for completeness.
Discord's API has 300+ endpoints. Most generators stop there - wrap every endpoint, ship it, done. But discrawl - Peter Steinberger's Discord tool - ignores most of them. It ships 11 commands: sync, search, sql, tail, mentions, members. 583 stars.
Why does the 11-command tool win? Because Steinberger saw something Discord's own API designers didn't: conversations are institutional knowledge. Every message thread is a document that should be archived, indexed, and searched locally. Those 11 commands embody that insight. The 300 endpoint wrappers don't.
Until now, you had to choose: breadth (wrap every endpoint) or depth (understand the user). The printing press eliminates that choice. It generates the full API surface AND matches every feature the top competitor has AND adds the discrawl-style intelligence layer AND an MCP server. One spec in. Everything out.
The GOAT CLI isn't built by finding gaps. It's built by absorbing every good idea and compounding on top.
Layer 1, absorb. Before generating, the ecosystem absorb gate catalogs every feature from every Claude Code plugin, MCP server, community skill, competing CLI, and automation script for your API. Every feature becomes a row in the absorb manifest, something our CLI must match AND beat with offline support, agent-native output, and SQLite persistence. The system even auto-suggests novel features it thinks are missing from the ecosystem before you approve the manifest.
Layer 2, transcend. Once you have everything in SQLite, compound use cases emerge that no stateless tool can do. Velocity tracking requires historical cycle data. Churn risk requires joining charges + subscriptions. Bottleneck detection requires the full issue relationship graph. These are the Non-Obvious Insight commands, and they only work because Layer 1 put everything in a local database.
The GOAT = everything everyone else does + everything nobody else thought of.
Most API CLIs stop at Rung 1. The printing press climbs to Rung 5.
| Rung | What it is | Auto-generated? | Example |
|---|---|---|---|
| 1 | API wrapper commands | Yes (from spec) | issue create --title "..." |
| 2 | Output formatting | Yes (always) | --json, --select, --csv, --dry-run |
| 3 | Local persistence | Yes (conditional) | sync, search, export, tail |
| 4 | Domain analytics | Yes (from archetype) | stale --days 30, orphans, load |
| 5 | Behavioral insights | Yes (from archetype) | health (composite score), similar (duplicate detection) |
Rung 3 is table stakes. Rung 4 is where discrawl lives. Rung 5 is where nobody else is yet.
The press generates the API wrapper in Phase 2 (Rung 1-2). Then it generates the discrawl-style data layer and workflow commands in Phase 3 (Rung 3-5) from domain archetype templates. Both in one run.
When choosing between Peter Steinberger's gogcli (6.5K+ stars, Go) and Google's official Workspace CLI (10K+ stars in a week, Rust), we ran /last30days - a recency research skill - across 34 X posts, 5 YouTube videos, and 10 web sources.
The verdict: use gogcli. The newer, official tool with 10x the API coverage lost to the older third-party one. As one user put it: "my preference is 100% gogcli since I have my agent working a lot with Google Docs and sheets, and gogcli just makes him able to do what he needs to do."
Breadth doesn't beat depth. Understanding the user beats understanding the API.
The NOI is the creative intelligence. The printing press generates both interfaces from one spec:
<api>-pp-cli. Cobra CLI for humans plus shell agents (Claude Code, Codex, Gemini CLI).<api>-pp-mcp. MCP server for Claude Desktop, Cursor, Windsurf, Cline. Auto-discovered, no shell needed.Same internal/client, same internal/store, same auth. Two binaries, zero code duplication.
CLIs win for agents. 100x fewer tokens than MCP tool definitions. LLMs were trained on shell interactions. Exit code 0 = done. --json | jq is a first-class composition pattern.
MCP wins for IDE integration. Claude Desktop and Cursor discover tools automatically via MCP. No shell needed. The MCP server exposes the same operations as the CLI, including the data layer (sync, search, sql).
One spec -> cli-printing-press generate -> <api>-pp-cli (cobra) + <api>-pp-mcp (MCP server)
| |
same internal/client, internal/store
Every API that gets a CLI+MCP becomes instantly accessible to every AI coding tool. The printing press is the factory.
The fast path is a lean loop. Artifacts still matter, but only when they directly improve the next phase.
Phase 0 Resolve + Reuse (1-3 min) Reuse research, detect tokens, resolve spec or URL
Phase 1 Research Brief (5-10 min) API identity, competitors, data layer, product thesis
Phase 1.5 Ecosystem Absorb Gate (5-10 min) Catalog every MCP/skill/CLI feature -> absorb manifest + novel suggestions
Phase 1.7 Browser-Sniff Gate (2-5 min) Browser capture, HAR import, discovery provenance
Phase 2 Generate (1-2 min) Go CLI + MCP server from spec with validation
Phase 3 Build The GOAT (10-20 min) ALL absorbed features + transcendence commands
Phase 4 Shipcheck (3-8 min) Dogfood + verify --fix + scorecard as one verification block
Phase 5 Live Smoke (optional) (2-5 min) Read-only API smoke + data-flow check
That Phase 0..5 table is a compression map. The skill's live IDs are the phases/NN-*.md filename stems (10-generate, 12-shipcheck, 18-dogfood-testing). Receipts and resume pointers use those stems.
Three entry paths. Got an OpenAPI spec? Use --spec. Got a URL to a website with no docs? The browser-sniff gate launches a browser, captures traffic, and generates the spec. Got a HAR file from DevTools? Pass --har. The press handles all three.
Published CLIs live in the Printing Press Library. The repo no longer carries a source catalog; new and updated CLIs should be published through the public-library workflow so the listing, skills mirror, and release metadata stay in one place.
Discovery provenance. When the press sniffs a website, it archives everything - pages visited, endpoints discovered, response samples, rate limiting events, and traffic-analysis.json with protocol/auth/protection signals and discovery warnings - into a discovery/ manuscript alongside the research and proofs. Full audit trail.
Full pipeline contract. The fast path above compresses a longer 9-phase managed pipeline: preflight, research, scaffold, enrich, regenerate, review, agent-readiness, comparative, ship. Inputs, outputs, gates, and artifacts for each phase are documented in docs/PIPELINE.md. Use it when you want to stop at any phase, resume later, re-run one step, or port the flow to another tool.
MCP spec surface (advanced config)The generator ships three opt-in knobs on the spec's mcp: block, aligned with Anthropic's production-agent MCP guidance:
mcp: transport: [stdio, http] # remote-capable for cloud-hosted agents; default [stdio] addr: "127.0.0.1:7777" # loopback bind; ":7777" listens on every interface and requires TLS orchestration: code # "endpoint-mirror" (default), "intent", or "code" endpoint_tools: hidden # suppress raw endpoint tools when intents cover the surface intents: # compose multi-step tools declaratively - name: create_issue_from_thread description: "Create an issue from a Slack thread." params: - { name: thread_id, type: string, required: true, description: "slack thread id" } steps: - endpoint: messages.get_thread bind: { thread_id: "${input.thread_id}" } capture: thread - endpoint: issues.create bind: { title: "${thread.subject}", description: "${thread.body}" } capture: issue returns: issue
Run cli-printing-press mcp-audit after changes to see which library CLIs would benefit from the new surface.
Designed for AI agents. Every flag, every output format, every exit code is chosen because an agent will consume it. Human-friendly table output in the terminal. Auto-JSON when piped, no flag needed. --compact drops to high-gravity fields only (id, name, status, timestamps), 60-80% fewer tokens. Typed exit codes (0=success, 2=usage, 3=not found, 4=auth, 5=API, 7=rate limited) let agents self-correct in one retry without parsing error text. --dry-run lets agents explore safely. Humans benefit from all of this too. Agent-native design is just good CLI design taken seriously.
Agent-first flags (every command): --json, --select, --dry-run, --stdin, --csv, --compact, --quiet, --yes, --no-input, --no-cache, --no-color. Auto-JSON when piped (no --json needed). Typed exit codes as above.
Actionable errors. Errors include the specific flag/arg that's wrong, the correct usage pattern, and the command path. Agents self-correct in one retry.
Bounded output. List commands show "Showing N results. To narrow: add --limit, --json --select, or filter flags." Token-conscious --compact mode returns only high-gravity fields, 60-80% fewer tokens.
Table stakes features (from the absorb gate). Every feature the top competitor has, classified and built before novel features. If schpet/linear-cli has start (git branch from issue), you get it. If 4ier/notion-cli has human-friendly filters, you get it. Anti-gaming rules prevent scorecard optimization over real features.
Data layer (high-gravity entities). Domain-specific SQLite tables with proper columns (not JSON blobs), FTS5 full-text search, incremental sync with cursor tracking, sql command for raw queries, domain-specific UpsertX() and SearchX() methods.
Workflow commands (from archetype): stale, orphans, load, etc.
Insight commands (Rung 5): health (composite score), similar (duplicate detection), trends, bottleneck, forecast, patterns.
Production-ready output. Command name normalization (retrieve-a -> get, post -> create, patch -> update); .printing-press.json provenance manifest; "Sources and Inspiration" section in each generated README; proxy-envelope support for APIs that wrap requests in a POST envelope; adaptive rate limiting on browser-sniffed APIs (start slow, ramp on success, back off on 429); minimum 1 test file per package; .goreleaser.yaml plus Homebrew formula plus GitHub Actions CI; REST or GraphQL specs both supported; MCP server auto-emitted at cmd/api-mcp/main.go; cursor-based pagination, batch SQLite transactions, tuned pragmas, --since incremental sync, and --concurrency parallel workers in every sync (discrawl-inspired).
The profiler classifies every API into a domain archetype and auto-generates the right workflow + insight commands:
| Archetype | Detected by | Auto-generated commands |
|---|---|---|
| Project Management | issue/task/ticket resources, assignee fields, priority levels | stale, orphans, load, health, similar |
| Communication | message/channel/thread resources, threading fields | health, similar |
| Payments | charge/payment/invoice resources, amount/currency fields | reconcile, revenue, health, similar |
| Infrastructure | server/deploy/instance resources | health, similar |
| Content | document/page/block resources | health, similar |
The archetype is detected automatically from the spec. The entity mapper figures out which resource is the "primary entity" (issues for PM, messages for comms, charges for payments) and wires the templates accordingly.
Four mechanical checks before a CLI can ship: a two-tier scorecard, structural dogfood, proof of behavior, and (when an API key is present) a live read-only smoke test. No vibes, no self-assessment.
Three benchmarks shape the scorecard, all must pass:
Architecture without features is a toy. Features without architecture is a thin wrapper. Quality without either is polished nothing.
Inspired by Peter Steinberger's gogcli. Two tiers, weighted 50/50. Grade A = 85+.
Tier 1: infrastructure (50 points). Does the skeleton have the right patterns?
| Dimension | What it checks |
|---|---|
| Output Modes | --json, --csv, --select, --quiet, --compact, auto-JSON when piped |
| Auth | OAuth flow, format-aware headers (Bot/Bearer/Basic from spec) |
| Error Handling | Typed exits, retry with backoff, actionable error messages |
| Agent-Native | --json, --select, --dry-run, --stdin, --no-input, --compact, --yes |
| + 5 more | Terminal UX, README, Doctor, Local Cache, Breadth |
Tier 2: domain correctness (50 points). Does the code actually work?
| Dimension | What it checks |
|---|---|
| Path Validity | Generated paths exist in the OpenAPI spec |
| Auth Protocol | Auth format matches spec's securitySchemes |
| Data Pipeline | Sync calls domain-specific UpsertX(), not generic Upsert() |
| Sync Correctness | Real resources, nested paths, pagination, incremental cursors |
| Type Fidelity | String IDs (not int), required params marked, quality descriptions |
| Dead Code | No unwired flags, no uncalled functions, no ghost tables |
Why two tiers? A scorecard that only checks syntax ("does this string exist in the file?") misses semantics ("does this code actually work?"). The two-tier system forces both breadth and depth.
Anti-gaming rules prevent optimizing for score instead of features. Table stakes (features competitors have) are Priority 1. Scorecard optimization is Priority 4.
# Quality scorecard: two-tier scoring (infrastructure + domain correctness) cli-printing-press scorecard --dir ./my-pp-cli --spec ./openapi.json # Dogfood: catches dead flags, dead functions, auth mismatches, invalid paths cli-printing-press dogfood --dir ./my-pp-cli --spec ./openapi.json # Runtime verification: tests every command against real API or mock server cli-printing-press verify --dir ./my-pp-cli --spec ./openapi.json --api-key $TOKEN # Emboss audit: baseline snapshot for improvement cycle cli-printing-press emboss --dir ./my-pp-cli --spec ./openapi.json --audit-only
The scorecard checks structure. Proof of Behavior checks data flow: does sync.go actually call UpsertMessage on a table that search.go queries?
Four behavioral proofs:
If any proof fails, auto-remediation removes dead code and re-verifies. Hallucinated paths and auth mismatches are hard FAIL gates.
When you provide an API key at the start, Phase 5 runs read-only tests against the real API:
LIVE API TEST RESULTS
=====================
Auth: PASS (200 OK on doctor)
List: 3/3 passed (users, channels, guilds)
Get: 1/1 passed (user abc123)
Sync: PASS (5 pages synced, 12 blocks)
Search: PASS (3 results for "a")
Verdict: PASS - CLI works against real API
Safety: GET only, --limit 1, 10s timeout, stops on 401. Never creates, posts, or deletes anything.
cli-printing-press auth doctor scans every installed printed CLI's tools-manifest.json and reports whether its declared env vars are set, unset, or suspicious. Fingerprints show the first four characters of each set value, never the full token.
cli-printing-press auth doctor cli-printing-press auth doctor --json
Useful when an agent hits a 401 on a printed CLI: one command shows whether the token is missing, truncated, or shadowed by a stale value without having to inspect shell config. Offline, read-only, and exits 0 even when findings include "not set" or "suspicious" because this is diagnostic, not gating.
"Is this shippable?" triggers a fix cycle: identify top 3 issues, fix them, re-score. Max 3 iterations. No more dead-end assessments.
Published CLIs live in the Printing Press Library, organized by category, most with full MCP servers. Browse at printingpress.dev.
A small sample, see the full catalog for the rest:
| CLI | Category | What it does |
|---|---|---|
espn-pp-cli |
Media and Entertainment | ESPN sports data: scores, stats, standings across 17 sports. |
flightgoat-pp-cli |
Travel | Kayak nonstop search plus sniffed Google Flights, in one call. |
linear-pp-cli |
Project Management | 50ms compound queries against a local Linear mirror. |
kalshi-pp-cli |
Payments | Trade prediction markets from the terminal. |
recipe-goat-pp-cli |
Food and Dining | Trust-aware ranking across 37 recipe sites. |
Each newly published CLI ships a root AGENTS.md operating guide, a research manuscript, verification proofs, and a .printing-press.json provenance manifest.
/printing-press slash command doesn't appear. Restart or reload the agent session after installing the skills. For Claude Code, run npx -y skills@latest list -g -a claude-code to verify the install. For Codex, run npx -y skills@latest list -g -