Bundled skill validator fails because PyYAML is not installed or declared

What issue are you seeing?

The bundled skill-creator instructions tell Codex to validate skills by running:

scripts/quick_validate.py <path/to/skill-folder>

However, the bundled validator imports the third-party yaml module unconditionally:

import yaml

PyYAML is not installed in the Python environment selected by the script's #!/usr/bin/env python3 launcher, and the bundled skill does not declare or install that dependency. As a result, the official validation step fails before it can inspect the skill.

Current source references:

• Skill instructions: https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/skill-creator/SKILL.md
• Validator: https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/skill-creator/scripts/quick_validate.py

Steps to reproduce

1. Open Codex Desktop on a machine where the system/default Python does not already have PyYAML installed.
2. Create or select any skill directory.
3. Run the validator as instructed:

python3 ~/.codex/skills/.system/skill-creator/scripts/quick_validate.py ~/.codex/skills/<skill-name>

1. Observe:

Traceback (most recent call last):
  File ".../quick_validate.py", line 10, in <module>
    import yaml
ModuleNotFoundError: No module named 'yaml'

Environment reproduced in

• Codex Desktop
• macOS 26.5.2 (25F84)
• Python 3.14.6 selected by /usr/bin/env python3
• PyYAML not installed in that Python environment

Expected behavior

The validation command shipped and documented with skill-creator should run without requiring an undeclared global Python dependency.

Suggested fix

Prefer making quick_validate.py dependency-free for its constrained frontmatter checks. Alternatively, bundle or explicitly provision PyYAML and invoke the validator through a known managed environment or launcher.

Users should not need to modify the system-managed skill, install PyYAML globally, or infer an undocumented dependency to run the official validation step.

Additional information

A user-owned isolated wrapper such as uv run --with pyyaml ... works as a temporary workaround, but it does not correct the bundled instructions/validator mismatch.