# Setup Skillsgoat

> One-time SkillsGoat setup. Default is venv + scan. Use --goat only when you intend to link the collection into agent skill dirs. Use when installing SkillsGoat, refreshing fixture links, or adding SkillsGoat to a shared repo.

- Skill: `optimuslabs-io/setup-skillsgoat` (Agent Skill)
- Install (CLI): `npx skillmds@latest add optimuslabs-io/setup-skillsgoat`
- Raw SKILL.md: https://api.skillmd.com/api/skills/optimuslabs-io/setup-skillsgoat/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: optimuslabs-io (https://skillmd.com/u/optimuslabs-io)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/optimuslabs-io/setup-skillsgoat

---


# Setup SkillsGoat

Run this collection — including lint, selftest, pytest, and scanner evals —
in a **local or cloud sandbox** you already trust. Network C2 is inert;
running pasture scripts or a live agent is not. This repo does not
endorse a sandbox vendor. See [docs/SAFETY.md](../../../docs/SAFETY.md).

Default `./setup` creates a venv and does **not** link fixtures. Linking
is a goat: it loads malicious-looking skills into the agent path on
purpose.

## Research mode (default)

```bash
./setup
.venv/bin/goat lint
.venv/bin/goat selftest
.venv/bin/python -m pytest -q
.venv/bin/goat scan --scanners skillspector
```

## Goat load

```bash
./setup --goat
```

Type `GOAT` when prompted, or pass `--confirm-goat` in CI.

Flags: `--host claude,cursor,codex,github,grok` (default: auto-detect),
`--team` (requires `--goat`; also write this project's `.claude/skills`
+ `CLAUDE.md`), `--uninstall`, `--index-only`.