skill-installer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data and software archives from GitHub infrastructure to perform its primary function.
- [REMOTE_CODE_EXECUTION]: The skill installs external executable content (other skills) into the agent's local directory ($CODEX_HOME/skills). While it does not execute the downloaded content directly, it enables the introduction of unverified logic into the agent's runtime environment.
- [COMMAND_EXECUTION]: The skill invokes the system's git command to perform repository cloning and sparse checkouts.
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it processes external GitHub URLs that could point to malicious repositories.
- Ingestion points: Command-line arguments derived from user prompts in SKILL.md.
- Boundary markers: Absent. No warnings are provided to verify the reputation of external repositories before installation.
- Capability inventory: File system write access to skill directories and network access for downloads.
- Sanitization: Includes basic path traversal protection (Zip Slip mitigation) in the extraction logic but does not audit the content of the downloaded skills.
Audit Metadata