The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches curated skill lists and skill content from GitHub. While it defaults to an official repository from a well-known organization, it explicitly provides functionality to download content from any user-specified GitHub repository via the --repo and --url parameters.
[REMOTE_CODE_EXECUTION]: The skill installs external code (other skills) into the local filesystem. If the agent is directed to install a skill from an untrusted or malicious repository, it will download and deploy unverified code that is intended to be executed in subsequent sessions.
[PERSISTENCE]: Files are installed into the $CODEX_HOME/skills directory (typically ~/.codex/skills). This allows any malicious code installed through this skill to persist on the local system and be loaded automatically in future agent sessions.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests data from remote GitHub repository structures and directory listings (e.g., via scripts/list-skills.py).
Boundary markers: The instructions do not specify any delimiters or warnings to the agent to ignore instructions embedded within the fetched metadata or skill names.
Capability inventory: The skill has the capability to write files to the local disk and perform network requests.
Sanitization: There is no evidence of sanitization or validation of the names and descriptions of skills fetched from external repositories before they are presented to the agent.
[COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/list-skills.py, scripts/install-skill-from-github.py) to perform its tasks. These scripts manage network operations, git checkouts, and file system modifications.

skill-installer