Agent skill

Dload Fetch Tool

Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (vendor/bin/dload).

BSD-3-ClauseAuto-check passedBackend & APIs

Install Dload Fetch Tool

skills CLI

$ npx skills add php-internal/dload --skill dload-fetch-tool -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install php-internal/dload dload-fetch-tool --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/php-internal/dload.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/dload-fetch-tool .claude/skills/dload-fetch-tool && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "dload-fetch-tool" agent skill from https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool into .claude/skills/dload-fetch-tool/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dload-fetch-tool", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add php-internal/dload --skill dload-fetch-tool -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install php-internal/dload dload-fetch-tool --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/php-internal/dload.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/dload-fetch-tool .agents/skills/dload-fetch-tool && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "dload-fetch-tool" agent skill from https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool into .agents/skills/dload-fetch-tool/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dload-fetch-tool", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add php-internal/dload --skill dload-fetch-tool -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install php-internal/dload dload-fetch-tool --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/php-internal/dload.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/dload-fetch-tool .cursor/skills/dload-fetch-tool && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "dload-fetch-tool" agent skill from https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool into .cursor/skills/dload-fetch-tool/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dload-fetch-tool", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/php-internal/dload.git --path skills/dload-fetch-tool

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add php-internal/dload --skill dload-fetch-tool -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install php-internal/dload dload-fetch-tool --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/php-internal/dload.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/dload-fetch-tool .gemini/skills/dload-fetch-tool && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "dload-fetch-tool" agent skill from https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool into .gemini/skills/dload-fetch-tool/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dload-fetch-tool", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install php-internal/dload dload-fetch-tool

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add php-internal/dload --skill dload-fetch-tool -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/php-internal/dload.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/dload-fetch-tool .github/skills/dload-fetch-tool && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "dload-fetch-tool" agent skill from https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool into .github/skills/dload-fetch-tool/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dload-fetch-tool", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add php-internal/dload --skill dload-fetch-tool -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install php-internal/dload dload-fetch-tool --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/php-internal/dload.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/dload-fetch-tool .opencode/skills/dload-fetch-tool && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "dload-fetch-tool" agent skill from https://github.com/php-internal/dload/tree/1.x/skills/dload-fetch-tool into .opencode/skills/dload-fetch-tool/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dload-fetch-tool", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: dload-fetch-tool
GitHub stars: 105
Token cost: ~1.1k tokens
SKILL.md length: 415 words
Files: 5 (incl. references)
Skills in repo: 1
Repo updated: Oct 6, 2026
First seen: Oct 7, 2026
Licence: BSD-3-Clause

At a glance

Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (vendor/bin/dload).

Works in 5 steps: check what dload already knows → describe a missing tool inline → add the action → …
The user wants tool X (rr
SKILL.md covers Step 1 — check what dload…, Step 2 — describe a missing…, Step 3 — add the action and Step 4 — pick the destination…, plus 2 more sections
Calls composer and php; reaches w3.org; needs GITHUB_TOKEN

What it does

Dload Fetch Tool is an agent skill from php-internal/dload. Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (vendor/bin/dload). Use when the user wants tool X (rr, temporal, buf, a PHAR…) downloaded into the project or added to dload.xml, when a download picks the wrong asset or none, or when setting up dload's release cache (version registry) locally or in CI, including GitHub API rate limits.

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including reference files (for example `references/archive-mode.md`, `references/registry-entry.md` and `references/troubleshooting.md`).

It sits in Backend & APIs, covering Rate limiting. It works with GitHub. The repository describes itself as: Helps to download binaries from release assets. The licence is BSD-3-Clause.

When your agent uses it

The user wants tool X (rr
A PHAR…) downloaded into the project
Added to dload.xml
A download picks the wrong asset

Example prompts

“/dload-fetch-tool”

Requirements

A credential in GITHUB_TOKEN

Workflow steps

5 steps, taken from the step headings in SKILL.md.

check what dload already knows
describe a missing tool inline
add the action
pick the destination folder
run dload and verify

What it can do on your machine

Read from SKILL.md and the folder at commit 58ff7cd. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- composer
- php
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
- w3.org
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- GITHUB_TOKEN
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Dload Fetch Tool loads about 1.1k tokens when it runs, and up to ~4.9k if it reads all its reference files. Until then it costs about 102 tokens; SKILL.md has 415 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~102
When it runs · the whole SKILL.md, loaded when a task matches: ~1.1k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~4.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from php-internal/dload at commit 58ff7cd, republished under its BSD-3-Clause licence (© php-internal). 415 words, ~1,077 tokens.

Download SKILL.mdSave it as .claude/skills/dload-fetch-tool/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.

name: dload-fetch-tool
description: Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (`vendor/bin/dload`). Use when the user wants tool X (rr, temporal, buf, a PHAR…) downloaded into the project or added to `dload.xml`, when a download picks the wrong asset or none, or when setting up dload's release cache (version registry) locally or in CI, including GitHub API rate limits.

Download a GitHub binary or PHAR into a project with dload

The task — "tool X from GitHub, available in this project's folder" — turns on one question: does dload already know this tool? If yes, dload.xml gets one <download> line. If no, the tool is also described inline in the same file. Native binaries and .phar files are both first-class; they differ in a couple of fields.

Everything happens in the consuming project's own dload.xml (dload itself is installed via composer require internal/dload).

Step 1 — check what dload already knows

bash

./vendor/bin/dload software

Prints every built-in tool with its alias. Tool listed → Step 3. Not listed → Step 2.

Step 2 — describe a missing tool inline

Add a <software> block to the <registry overwrite="false"> element of the project's dload.xml. Read references/registry-entry.md first: it lists the facts to collect from the GitHub release and how to design asset-pattern and binary.pattern for binaries and PHARs.

Done when the block has a <repository> whose asset-pattern matches every OS/arch variant of the tool and nothing else in the release.

Step 3 — add the `<download>` action

xml

<?xml version="1.0"?>
<dload
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/php-internal/dload/refs/heads/main/dload.xsd"
    temp-dir="./runtime"
>
    <actions>
        <download software="buf" />
        <download software="trap" type="phar" version="^1.1" />
    </actions>
    <registry overwrite="false">
        <!-- inline <software> blocks from Step 2, if any -->
    </registry>
</dload>

Attribute	Purpose
`software`	Alias or name of the tool (built-in or inline). Required.
`version`	Composer-style constraint: `^2025.1`, `~1.0.0`, `^2.12.0@beta`, `^2.12.0-hotfix@rc`. Omit for latest stable. Stability order follows Composer, `stable` by default.
`extract-path`	Target folder (default: project root).
`type`	`binary` (default), `phar` (required for PHAR — skips extraction), `archive` (unpack the whole asset keeping its folder layout).

type="archive" is for tools that ship more than one executable — frontend bundles, docs, a binary that loads sibling libraries by relative path. Read references/archive-mode.md before using it.

The authoritative schema is vendor/internal/dload/dload.xsd.

Show full SKILL.md (152 more words)Show less

Step 4 — pick the destination folder

xml

<actions>
    <download software="rr" extract-path="./bin" />
    <download software="trap" type="phar" extract-path="./tools" />
</actions>

extract-path is the literal folder the file lands in, for binaries and PHARs alike. Keep the folder in VCS with a .gitkeep and put the downloaded file in .gitignore — only dload.xml belongs in git.

Step 5 — run dload and verify

bash

./vendor/bin/dload get             # every <download> entry in dload.xml
./vendor/bin/dload get <alias>     # one entry

Done when the tool runs: ./bin/rr --version, php ./tools/trap.phar --version.

Release lists are answered from a local cache — the version registry — for 10 minutes after the last check of a repository, so a release published moments ago may need dload get --refresh. For cache location and TTL, and for any CI setup — passing GITHUB_TOKEN and carrying the registry between runs, with GitHub Actions and GitLab examples — read references/version-registry.md.

When the download fails

dload get exits non-zero and prints, per failed tool, the API error, the releases it checked, their assets, and the filter that rejected them. Read that report, then walk the selection stages in references/troubleshooting.md.

Files

SKILL.md and 4 other files (references) in skills/dload-fetch-tool of php-internal/dload.

SKILL.md
references/archive-mode.md
references/registry-entry.md
references/troubleshooting.md
references/version-registry.md

Open the folder on GitHubat commit 58ff7cd

Compare with similar skills

Dload Fetch Tool next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Dload Fetch Tool compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Dload Fetch Tool this skillphp-internal/dload	105	—	~1.1k	Automated safety check: Pass	BSD-3-Clause	2 days ago
Repo2skillzhangyanxs/repo2skill	246	—	~3.6k	Automated safety check: Pass	None	7 mo ago
Better Auth Security Best PracticesEpicenterHQ/epicenter	4.8k	—	~896	Automated safety check: Pass	Custom licence	today
Apikerhodgef/apiker	127	—	~1.4k	Automated safety check: Pass	MIT	1 mo ago
Goosetown Researcher GitHubaaif-goose/goosetown	154	—	~1.6k	Automated safety check: Pass	Apache-2.0	3 mo ago
Implementing API Key Security Controlsmukul975/Anthropic-Cybersecurity-Skills	34k	—	~4k	Automated safety check: Pass	Apache-2.0	1 mo ago

Similar skills

Repo2skill
zhangyanxs/repo2skill
Convert GitHub/GitLab/Gitee repositories into comprehensive OpenCode Skills using embedded LLM calls with multiple mirrors and rate limit handling
246 GitHub stars~3.6k tokensUpdated 7 mo ago
Backend & APIsAuto-check passed
Better Auth Security Best Practices
EpicenterHQ/epicenter
Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging.
4.8k GitHub stars~896 tokensUpdated today
Backend & APIsAuto-check passed
Apiker
hodgef/apiker
Develop, review, and extend the Apiker library — a framework for building serverless REST APIs on Cloudflare Workers + Durable Objects.
127 GitHub stars~1.4k tokensUpdated 1 mo ago
Backend & APIsAuto-check passed
Goosetown Researcher GitHub
aaif-goose/goosetown
Search GitHub issues, PRs, code, and discussions using the gh CLI.
154 GitHub stars~1.6k tokensUpdated 3 mo ago
Backend & APIsAuto-check passed
Implementing API Key Security Controls
mukul975/Anthropic-Cybersecurity-Skills
Implements secure API key generation with sufficient entropy, server-side hashing (SHA-256/bcrypt) instead of plaintext storage, per-key scoping to endpoints/IPs/rate limits, zero-downtime rotation…
34k GitHub stars~4k tokensUpdated 1 mo ago
Backend & APIsAuto-check passed
Handle Issues
aaddrick/claude-pipeline
Batch process GitHub issues via batch-orchestrator.sh with rate limit handling and session resumption
130 GitHub stars~4k tokensUpdated 7 mo ago
Backend & APIsAuto-check passed

Works with

GitHub

Questions about Dload Fetch Tool

What does Dload Fetch Tool do?

Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (vendor/bin/dload). Dload Fetch Tool is an agent skill from php-internal/dload. Get a CLI tool — native binary or PHAR — from a GitHub release into a project folder with dload (vendor/bin/dload).

When should I use Dload Fetch Tool?

Dload Fetch Tool fits situations like: the user wants tool X (rr; A PHAR…) downloaded into the project; added to dload.xml; A download picks the wrong asset.

How do I install Dload Fetch Tool in Claude Code?

Run `npx skills add php-internal/dload --skill dload-fetch-tool -a claude-code`. Or copy the skill folder (skills/dload-fetch-tool in php-internal/dload) into .claude/skills/dload-fetch-tool in your project. Claude Code loads it when a task matches its description.

How do I install Dload Fetch Tool in Codex?

Run `npx skills add php-internal/dload --skill dload-fetch-tool -a codex`. Or copy the skill folder (skills/dload-fetch-tool in php-internal/dload) into .agents/skills/dload-fetch-tool in your project. Codex loads it when a task matches its description.

Can I use Dload Fetch Tool in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add php-internal/dload --skill dload-fetch-tool -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dload-fetch-tool, .gemini/skills/dload-fetch-tool, .github/skills/dload-fetch-tool and .opencode/skills/dload-fetch-tool in your project.

What does Dload Fetch Tool need to run?

Going by SKILL.md and its folder, Dload Fetch Tool needs the command-line tools its instructions call (composer and php) and credentials named GITHUB_TOKEN. Our summary lists: A credential in GITHUB_TOKEN.

Does Dload Fetch Tool access the network?

SKILL.md names 1 domain. In commands or code: w3.org; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Dload Fetch Tool safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Dload Fetch Tool use?

Dload Fetch Tool is published under the BSD-3-Clause licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Dload Fetch Tool use?

About 1.1k tokens (SKILL.md is roughly 4.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.8k tokens, read only when the agent opens those files.

What are the alternatives to Dload Fetch Tool?

Skills that share tags, products or a category with Dload Fetch Tool: Repo2skill (zhangyanxs/repo2skill, 246 stars), Better Auth Security Best Practices (EpicenterHQ/epicenter, 4.8k stars), Apiker (hodgef/apiker, 127 stars) and Goosetown Researcher GitHub (aaif-goose/goosetown, 154 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Dload Fetch Tool?

php-internal (a GitHub organization) maintains it in php-internal/dload, which has 105 GitHub stars. The repository was last updated on October 6, 2026.

Source: php-internal/dload on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Dload Fetch Tool

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Download a GitHub binary or PHAR into a project with dload

Step 1 — check what dload already knows

Step 2 — describe a missing tool inline

Step 3 — add the <download> action

Step 4 — pick the destination folder

Step 5 — run dload and verify

When the download fails

Files

Compare with similar skills

Similar skills

Repo2skill

Better Auth Security Best Practices

Apiker

Goosetown Researcher GitHub

Implementing API Key Security Controls

Handle Issues

Related

Questions about Dload Fetch Tool

Step 3 — add the `<download>` action