The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the system git binary to perform sparse checkouts of remote repositories. Commands are executed using argument lists rather than shell strings, preventing command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: Fetches skill content and metadata from well-known GitHub domains (api.github.com and codeload.github.com). It supports both public and private repositories by utilizing optional environment tokens (GITHUB_TOKEN, GH_TOKEN).
[INDIRECT_PROMPT_INJECTION]: The skill processes remote directory listings and skill metadata from external repositories. While this is an ingestion point for untrusted data, the code implements defensive checks including _validate_skill_name and _validate_relative_path to ensure skill names and paths do not escape the designated installation directory.
[REMOTE_CODE_EXECUTION]: While the skill's primary purpose is to download and install external code (skills), it implements a strict _safe_extract_zip function that validates file paths within archives to prevent 'ZipSlip' directory traversal attacks.

skill-installer