The Agent Skills Directory

External Code Downloads: The skill is designed to fetch community skills from external registries. To mitigate risk, it utilizes a pre-verified allowlist for registries and publishers, and it requires a read-only subagent for the analysis phase in restrictive mode to prevent unauthorized file operations during the fetch process.
Command Execution and Hooks: The installer identifies and flags execution hooks within candidate skills that run arbitrary shell commands. These are presented to the user for explicit review before any installation occurs, ensuring no commands are executed without awareness.
Indirect Prompt Injection Surface: As an installer that processes third-party SKILL.md files, the skill is exposed to potential injection attacks. It addresses this by scanning for common injection patterns (e.g., instructions to ignore previous rules) and treating all metadata—such as licenses and freshness dates—as data to be validated via strict regex matching rather than text for the AI to interpret.
Human-in-the-Loop Approval: The skill enforces a strict approval gate, requiring the user to type an explicit 'yes' after reviewing the raw source code and structural trust checks. It is designed to prevent the AI from inferring approval or proceeding based on earlier context.
Metadata Validation: The skill handles license strings and freshness metadata using a data-to-structured-display transform. By using strict pattern matching against a fixed list of SPDX identifiers, it prevents malicious instructions embedded in metadata fields from being processed as commands.

skill-installer