The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The skill's primary purpose is to download and install scripts into the $CODEX_HOME/skills directory, which are subsequently executed by the agent system. The instructions in SKILL.md explicitly support installing from any user-provided GitHub repository.
Evidence: SKILL.md outlines instructions for install-skill-from-github.py to download and overwrite files in the local skills directory.
EXTERNAL_DOWNLOADS (HIGH): The skill facilitates downloading content from external, unverified sources beyond the default curated list.
Evidence: SKILL.md and scripts/list-curated-skills.py allow overriding the repository source via the --repo argument.
CREDENTIALS_UNSAFE (MEDIUM): The skill accesses GITHUB_TOKEN and GH_TOKEN from the environment and includes them in the Authorization header of network requests.
Evidence: scripts/github_utils.py implements os.environ.get("GITHUB_TOKEN") and attaches it to urllib.request.Request headers. These credentials could be exposed if an attacker-controlled repository or path is passed to the script.
COMMAND_EXECUTION (MEDIUM): The skill uses Git (via fallback to sparse checkout) to manage files on the host system, which involves executing system-level commands with user-controllable parameters.
Evidence: SKILL.md mentions the use of git sparse checkout and method auto|download|git for installation tasks.

skill-installer