The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The skill's purpose is to download and install executable code ('skills') into the agent's environment. While it defaults to 'openai/skills', the instructions explicitly support user-specified repositories (e.g., --repo <owner>/<repo>), which could lead to the installation and subsequent execution of untrusted malicious code.\n- CREDENTIALS_UNSAFE (HIGH): The script scripts/github_utils.py retrieves the GITHUB_TOKEN and GH_TOKEN environment variables. These sensitive credentials could be exfiltrated if the agent is compromised by a malicious skill downloaded through this tool.\n- EXTERNAL_DOWNLOADS (HIGH): The skill performs network operations to fetch directory listings and file contents from the GitHub API using urllib.request.\n- COMMAND_EXECUTION (MEDIUM): The skill executes local Python helper scripts to manage the file system and network tasks required for installation.\n- PROMPT_INJECTION (HIGH): The skill is vulnerable to Indirect Prompt Injection (Category 8). An attacker could host a repository containing malicious instructions that the agent would ingest during the 'list' or 'install' phase. Evidence: (1) Ingestion point: GitHub API contents in scripts/list-skills.py; (2) Boundary markers: Absent; (3) Capability inventory: Network access and file installation/persistence; (4) Sanitization: None.

skill-installer