When you review a PR, have you done this too? Open ChatGPT, paste the same checklist again — check security, performance, test coverage, grade findings as Critical/Warning — and hope it does not miss the SQL injection this time. Next week another PR lands. Paste it all again.
Skills exist to fix exactly that. You write your review standards into a SKILL.md, install it once, and then just say “review this PR.” ChatGPT knows which workflow to run and what format to output. No re-teaching every time. Code review, README drafts, Changelog generation, incident postmortems — anything you do every week with nearly the same steps is worth turning into a Skill.
This article skips concept overload and gives you 30 Skills developers should actually install, grouped by scenario, with guidance on what to install first, how to build your own, and how to pair them with Codex. If you have not touched Work yet, start with ChatGPT Work & solo software company. Comparing coding tools? See Claude 4 vs GPT-5 coding comparison.
I. How to use
Once installed, day-to-day use boils down to three patterns:
Most common: just say what you want. “Review this PR” or “write this week’s dev report” — ChatGPT picks the right Skill. That covers most cases.
When you are not sure: specify manually. Type @ in the input and pick a Skill (use $ in Codex). Best when multiple Skills might collide or you want to force a specific workflow.
Complex flows you do not want to write out: use Record & Replay — perform the steps once, and ChatGPT generates a Skill from the recording. Good for multi-step jobs that are hard to describe in text, like pulling data from GitHub + Slack every week for a status report.
One caveat: team workspaces may ship with Skills off by default (still beta as of early 2026). Admins need to enable it in settings. Plus/Pro users can use Skills directly in the desktop Work app and Codex. More detail in OpenAI’s official docs.
II. Tier system: Must-have / Recommended / Advanced
The 30 Skills below are ordered by how often developers reach for them, with a recommended tier:
- Must-have — you will use these almost every week; install now and save time immediately
- Recommended — high frequency in specific scenarios; pick by stack
- Advanced — bigger payoff once you are team-sized or scaling
You do not need all 30 on day one. Start with the first five must-haves, use them for a week, then add more based on pain points.
III. Code & engineering (1–10)
These Skills sit on write, change, and review. They complement Codex’s coding mode: Codex writes; these Skills review to your standard and format output consistently.
| # | Skill | What it does | Tier | Source |
|---|---|---|---|---|
| 1 | PR Code Review | Review pull requests against team rules: security, performance, readability, test coverage — graded comments | Must-have | Plugin directory / Custom |
| 2 | Commit Message Writer | Generate Conventional Commits messages from a diff | Must-have | Custom |
| 3 | Bug Triage Analyzer | Read issues/crash logs, classify severity, hypothesize root cause, suggest repro steps | Must-have | Custom |
| 4 | API Design Review | Review REST/GraphQL design: naming, versioning, error codes, pagination, idempotency | Recommended | Custom |
| 5 | SQL Query Optimizer | Analyze slow queries; suggest indexes, SQL rewrites, and execution-plan impact | Recommended | Custom |
| 6 | TypeScript Refactor | Safe refactors: extract types, remove any, migrate toward strict mode, with change notes | Recommended | Custom |
| 7 | Regex Builder | Turn natural-language match requirements into regex with test cases and explanation | Recommended | Plugin directory |
| 8 | Code Migration Assistant | Framework/language upgrade checklist: dependency compatibility, breaking changes, phased migration plan | Recommended | Custom |
| 9 | OpenAPI Spec Generator | Generate OpenAPI 3.x from code or API descriptions, with example requests/responses | Advanced | Custom |
| 10 | Dependency Upgrade Planner | Scan package.json / requirements.txt; rank upgrade suggestions by risk; flag breaking changes | Advanced | Custom |
Install #1–#3 first. Solo developers have no colleague to review code — PR Code Review is a senior reviewer that never clocks out. Commit Message Writer and Bug Triage cover the two highest-frequency chores every day.
IV. DevOps & infrastructure (11–18)
iOS/Mac developers and anyone running CI/CD benefit most here. If you use self-hosted Mac Runners on GitHub Actions, pair these with Mac Runner TCO planning.
| # | Skill | What it does | Tier | Source |
|---|---|---|---|---|
| 11 | Dockerfile Generator | Multi-stage Dockerfile for your project type, plus .dockerignore and security best practices | Must-have | Custom |
| 12 | GitHub Actions Writer | Generate CI/CD workflows: test, build, deploy — caching and matrix strategies included | Must-have | Plugin directory / Custom |
| 13 | Deploy Checklist | Pre-release checklist: env vars, DB migrations, rollback plan, monitoring alerts | Must-have | Custom |
| 14 | CI Pipeline Review | Audit existing pipelines: bottlenecks, redundant steps, security issues (leaked secrets, over-broad permissions) | Recommended | Custom |
| 15 | Log Analyzer | Parse app/system logs, spot anomaly patterns, correlate timelines, output root-cause hypotheses | Recommended | Custom |
| 16 | Infrastructure Cost Estimator | Estimate monthly cloud spend from architecture: compute, storage, bandwidth, API volume | Recommended | Custom |
| 17 | Incident Postmortem | SRE-style postmortem: timeline, root cause, blast radius, action items | Recommended | Custom |
| 18 | K8s Manifest Generator | Deployment/Service/Ingress YAML with resource limits and health checks | Advanced | Custom |
GitHub Actions Writer + Deploy Checklist are the antidote to release anxiety. Many indie developers are not afraid of writing code — they are afraid of which step they forgot before shipping. Turn the checklist into a Skill and run the same flow every release.
V. Docs & knowledge (19–24)
Developers hate writing docs, but docs decide whether a product gets used. These Skills will not think for you — they keep format consistent, structure complete, and key sections from being skipped.
| # | Skill | What it does | Tier | Source |
|---|---|---|---|---|
| 19 | README Generator | README from code structure: install, config, usage, contributing, license | Must-have | Plugin directory / Custom |
| 20 | Changelog Writer | Keep a Changelog format from git log or PR list | Must-have | Custom |
| 21 | Technical Blog Draft | Turn notes/meeting records into publishable blog drafts with SEO title and summary | Recommended | Custom |
| 22 | ADR Writer | Architecture Decision Record: context, options, decision, consequences | Recommended | Custom |
| 23 | Runbook Writer | Ops procedures as runbooks: prerequisites, steps, verification, rollback, contacts | Recommended | Custom |
| 24 | Onboarding Guide | New-hire guide: environment setup, code layout, first PR, common commands | Advanced | Custom |
Building an AI product and writing technical blogs for acquisition? Technical Blog Draft plus README Generator can shrink “shipped the feature → wrote about it” from days to hours.
VI. Quality, security & collaboration (25–30)
The last six cover testing, security audits, and team coordination — easy to skip as a solo founder, mandatory once you have paying users. More pre-launch checks in first 100 users pitfalls.
| # | Skill | What it does | Tier | Source |
|---|---|---|---|---|
| 25 | Test Case Generator | Unit tests and edge cases from function/API signatures, with mock strategy | Must-have | Custom |
| 26 | Security Audit Checklist | OWASP Top 10 pass: injection, XSS, auth, sensitive data exposure | Must-have | Custom |
| 27 | Dependency Vulnerability Scan | Interpret npm audit / pip audit output; rank fixes by exploitability | Recommended | Plugin directory / Custom |
| 28 | Weekly Dev Report | Summarize commits, PRs, and issues into a weekly report or standup update | Recommended | Custom |
| 29 | Sprint Retro Summary | Sprint retrospective from iteration data: went well, needs work, next-sprint actions | Advanced | Custom |
| 30 | Privacy Policy Drafter | Privacy policy draft from product features: collection, storage, third-party sharing, user rights | Advanced | Custom |
Security Audit Checklist deserves emphasis: AI-generated code may not account for SQL injection or hardcoded secrets. Make this Skill the last gate before every release — far cheaper than fixing it in production.
VII. Install & enable
As of July 2026, there are three ways to install Skills:
7.1 From the plugin directory (fastest)
- Open the ChatGPT desktop app and switch to Work mode.
- Go to Settings → Plugins and browse the directory.
- Search for keywords like
code review,github,documentation. - Click Install — bundled Skills become available automatically.
7.2 Let ChatGPT build it (most flexible)
- Start a new chat and type: “Build me a skill that…”
- Be specific: task goal, input format, output format, quality checks.
- ChatGPT drafts
SKILL.md; review and click Install. - Test on a real task; refine until it behaves.
7.3 Manual upload (most control)
Best when you want Skills in Git with version control:
my-skill/
├── SKILL.md # Required: name + description + workflow instructions
├── templates/ # Optional: output templates
├── examples/ # Optional: good/bad examples
└── scripts/ # Optional: helper scripts
SKILL.md needs at minimum YAML front matter:
---
name: pr-code-review
description: Review pull requests for security, performance, and style.
---
# PR Code Review
## Steps
1. Read the diff and identify changed files.
2. Check for security issues (injection, hardcoded secrets).
3. ...
## Output Format
- 🔴 Critical / 🟡 Warning / 🟢 Suggestion
- Each item: file:line, issue, suggested fix
Upload via Settings → Skills → Upload, or manage local Skills with the Codex CLI /skills command.
VIII. Build your own Skill
Instead of waiting for someone else’s template, upgrade prompts you already use every week into a Skill. Fastest path with “PR Code Review” as the example:
- Pick a weekly task you re-explain every time. Example: “When I review PRs I check security, performance, test coverage, and commit granularity.”
- Open a new chat and type:
Build me a skill called "PR Code Review". When I paste a diff or PR link, review it for: (1) security vulnerabilities, (2) performance issues, (3) test coverage gaps, (4) code style consistency. Output findings as Critical/Warning/Suggestion with file:line references.
- Review the generated SKILL.md and add team-specific rules (e.g. “every API must have rate limiting”).
- Install and test on a real PR. If step two misses SQL injection, say so and refine.
- Share with the team (if workspace settings allow), or export to a Git repo for versioning.
IX. Pairing with Codex
Skills are not standalone — they are one piece of an AI dev workflow. A mature 2026 setup looks like this:
| When | Tool | Job | Example Skills |
|---|---|---|---|
| Morning planning | ChatGPT Work | Email triage, task list, daily summary | Weekly Dev Report |
| Daytime coding | Codex / Cursor | Features, bugs, tests | Test Case Generator, TypeScript Refactor |
| Before commit | Codex $pr-code-review | Self-review code quality | PR Code Review, Commit Message Writer |
| Before release | ChatGPT Work | Checklist, Changelog | Deploy Checklist, Changelog Writer |
| After incident | ChatGPT Work | Log analysis, postmortem | Log Analyzer, Incident Postmortem |
| Weekend content | ChatGPT Work | Tech blog, doc updates | Technical Blog Draft, README Generator |
Already running a personal AI agent stack? Skills are the fourth piece: they standardize repeat flows so you stop copy-pasting the same instructions between Work and Codex.
On the Plugin side, watch for bundles with GitHub + Google Drive — Skills can pull PR diffs and design docs without manual paste.
Quick picks by role
Not sure where to start? Pick a starter pack by role:
| Role | Starter pack (5) | Week two |
|---|---|---|
| Solo developer | #1 PR Review, #2 Commit Msg, #11 Dockerfile, #19 README, #25 Test Case | #13 Deploy Checklist, #20 Changelog, #26 Security Audit |
| Full-stack engineer | #1, #4 API Design, #12 GHA Writer, #15 Log Analyzer, #22 ADR | #5 SQL Optimizer, #14 CI Review, #17 Postmortem |
| iOS/Mac developer | #1, #12 GHA Writer, #13 Deploy Checklist, #19 README, #28 Weekly Report | #8 Migration, #23 Runbook, plus iOS CI/CD |
| Tech lead | #1, #14 CI Review, #17 Postmortem, #24 Onboarding, #29 Sprint Retro | #9 OpenAPI, #18 K8s, #30 Privacy Policy |
X. FAQ
What is the difference between Skills and Plugins?
A Skill is a reusable workflow instruction pack that tells ChatGPT how to complete a specific task. A Plugin is an installable bundle that can include multiple Skills and connect to external services like GitHub or Google Drive (via MCP). You install a Plugin for tools; you use a Skill for a standard process.
Do Skills cost extra?
Skills are included in ChatGPT Plus/Pro/Team subscriptions — no separate fee. Some third-party Plugins may have their own pricing. Building your own Skill is free; you only use normal AI conversation credits.
Can both Codex and ChatGPT Work use Skills?
Yes. Skills follow the open Agent Skills standard and work in ChatGPT desktop (Work mode), Codex CLI, and IDE extensions. Use @ in ChatGPT and $ in Codex.
How do teams share Skills?
Workspace admins enable Skills creation and sharing in Settings → Permissions. Members can publish to the workspace for others to install. You can also package as a Plugin for the directory, or export SKILL.md to a Git repo.
Will Skills replace Cursor Rules or CLAUDE.md?
Not exactly. Cursor Rules / CLAUDE.md are persistent IDE-level context; Skills are task-level reusable workflows. Best practice: IDE rules for global coding style; Skills for complete flows on specific tasks. Use both.
What if auto-matching picks the wrong Skill?
Three fixes: use @ to specify a Skill explicitly; sharpen the description in SKILL.md so triggers are clear; set allow_implicit_invocation to false to require manual invocation and avoid misfires.
Skills handle process — cloud Mac handles execution
ChatGPT Work Skills standardize review, docs, and release flows, but CI/CD needs a machine that stays online. Close the laptop and long jobs and overnight builds stop.
Nuvcloud cloud Mac mini is built for self-hosted GitHub Actions Runners, Xcode builds, and background tasks — Skills review code by day, Mac runs the pipeline at night. See pricing, or read iOS CI speed.