Official AI Skill

Typical workflows

• Create a new intake form and keep it disabled until its fields are configured.
• Adjust form fields, like adding or renaming fields, under your key's scopes.
• Read unread submissions across your granted forms.
• Inspect, edit, validate, and publish a form's workflow.
• Run a workflow dry test and explain each step's result.
• Review failed workflow runs and retry eligible work after confirmation.

What the Skill does at runtime

• It calls capabilities() before work and stays within the Key's scopes, form grants, write state, and rate limits.
• It reads current state before sensitive changes and requires an exact, fresh confirmation for enabling forms, destructive actions, workflow test, publish, restore, and retry.
• Workflow dry runs do not send real delivery messages. AI steps still consume Compute Points when they execute.
• Codex, Claude Code, OpenCode, and Pi use the same verified Skill bundle; other Agent runtimes are not currently validated.

Read first, then confirm

Enabling a form, deleting resources, and large mark-read batches are never applied silently. The Skill reads state first, then asks for an explicit, exact confirmation before performing the change.

Safety boundaries

• The SUBMETO_API_KEY environment variable belongs only in the Skill's server-side runtime.
• Never paste your API Key into chat, source control, browsers, or mobile artifacts. If a key leaks, create a replacement and revoke the old one.
• The Skill is a restricted wrapper of the Public API — it cannot bypass scopes, form grants, or confirmations.

Relationship to the Public API

The Skill talks to Submeto through a typed client wrapper on top of the Public API. Your API Key needs the right scopes and form grants, and every capability check, pagination bound, and confirmation rule of the Public API applies.

Install with your Agent

Choose your Agent and copy the installation prompt into a session. The Agent downloads, verifies, installs, and validates the official Skill, then guides you through API Key setup without asking you to expose the Key in chat.

Install or update the official Submeto Public API Skill for Codex by following https://submeto.com/downloads/submeto-public-api-skill-install.md.

Complete the manifest lookup, immutable archive download, SHA-256 verification, user-level installation, and bundled validation yourself. Do not modify unrelated files. If an existing installation would be replaced, compare versions and ask before replacing it.

After installation, guide me to enable Public API myself in Submeto Dashboard if it is disabled, then help me create a least-privilege Public API Key and configure it as SUBMETO_API_KEY in the runtime's server-side environment. Do not accept the risk notice or call the session-only activation endpoint for me. Never ask me to paste, display, or echo the key in chat, and never store it in a repository. Finally, explain any reload or restart needed and verify the connection through capabilities(). Stop if any download, checksum, archive, or validation check fails.