agentic-awesome-skills-installer
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides commands to download software and content from an unverified third-party repository ("github.com/sickn33/agentic-awesome-skills") and an npm package ("agentic-awesome-skills"). This includes installation methods using git clone, curl, and npx.
- [REMOTE_CODE_EXECUTION]: The skill encourages the execution of code downloaded at runtime via npx. It also provides Python and JavaScript examples that use subprocess.run or child_process to execute these external tools on the local system.
- [COMMAND_EXECUTION]: The instructions include shell commands for the agent to modify the file system, such as rm -rf to delete directories and chmod -R u+w to change file permissions. It also instructs the agent to modify sensitive tool configuration files like .cursor/settings.json and ~/.claude/plugins/config.json.
- [PROMPT_INJECTION]: The skill facilitates the mass installation of 1,935+ unvetted instruction files ("playbooks") from an external source, creating a large surface for indirect prompt injection where the agent may follow malicious instructions embedded in the downloaded files.
- Ingestion points: The ~/.agents/skills directory and tool-specific plugin paths used by Claude, Cursor, and other assistants.
- Boundary markers: No delimiters or instructions to ignore embedded commands are implemented for the downloaded content.
- Capability inventory: The skill environment allows for shell execution, file system modification, and network operations.
- Sanitization: No mechanism is provided to validate or sanitize the content of the thousands of downloaded skill files before they are ingested by the agent.
Audit Metadata