The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is configured to download content from GitHub. While it targets the official OpenAI skills repository by default, it also allows users to specify arbitrary GitHub repositories and paths for installation.
[REMOTE_CODE_EXECUTION]: The core functionality is the installation of new skills (which include executable scripts) from remote sources into the local environment ($CODEX_HOME/skills). This represents a 'download then execute' pattern from potentially unverified sources.
[COMMAND_EXECUTION]: The skill leverages internal Python scripts to perform network requests and filesystem modifications. These scripts are granted elevated permissions to manage the installation process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and displays information (such as skill names and descriptions) from remote repositories, which serves as an attack surface for instructions embedded in external metadata.
Ingestion points: Fetches curated skill lists and repository contents via the GitHub API and direct downloads.
Boundary markers: No delimiters or safety instructions are specified to prevent the agent from being influenced by maliciously crafted skill metadata in remote repositories.
Capability inventory: The skill possesses the ability to write to the filesystem and execute scripts, which could be leveraged if the agent is manipulated by injected content.
Sanitization: The instructions do not mention any validation or sanitization of the remote content before it is presented to the user or processed by the system.

skill-installer