The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches skill content from OpenAI's official GitHub repository and user-provided sources via the GitHub API and ZIP archive downloads. It also utilizes git clone for sparse checkouts.- [COMMAND_EXECUTION]: Executes the git command-line tool using subprocess.run. The script passes arguments as a list, which is a secure practice that prevents shell injection.- [REMOTE_CODE_EXECUTION]: The skill installs executable code from remote repositories into the agent's environment. It implements path validation and ZipSlip protections to ensure files are extracted only to the intended destination.- [CREDENTIALS_UNSAFE]: Accesses GITHUB_TOKEN or GH_TOKEN environment variables to authenticate with the GitHub API. The implementation includes logic to ensure these credentials are only transmitted to github.com and api.github.com domains.

skill-installer