The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/install-skill-from-github.py uses subprocess.run to execute system git commands for repository cloning and checkout operations.
Evidence: Implementation found in the _run_git and _git_sparse_checkout functions. The skill uses argument lists rather than shell strings, which is a secure method for executing subprocesses that mitigates shell injection risks.
[EXTERNAL_DOWNLOADS]: The skill downloads compressed archives from GitHub and extracts them to the local file system.
Evidence: The _download_repo_zip function fetches content from GitHub's ZIP download service (codeload.github.com). The _safe_extract_zip function includes logic to verify that extracted files remain within the target destination directory, effectively preventing directory traversal (ZipSlip) vulnerabilities.

skill-installer