The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates downloading skill packages from github.com and codeload.github.com. This is a core feature for remote skill installation and is scoped to well-known domains.
[COMMAND_EXECUTION]: Uses the git CLI via Python's subprocess.run to perform repository clones and sparse checkouts. The implementation uses argument lists rather than shell strings, which is a standard security practice to prevent command injection.
[CREDENTIALS_UNSAFE]: The script accesses GITHUB_TOKEN and GH_TOKEN environment variables to authenticate API requests. While this involves sensitive credential access, it is performed for the intended purpose of accessing private repositories as described in the skill documentation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and install content from external repositories, creating an attack surface where malicious metadata or instructions in the downloaded skills could influence the agent's behavior.
Ingestion points: scripts/list-skills.py (fetches directory names via GitHub API) and scripts/install-skill-from-github.py (downloads and extracts full repository archives).
Boundary markers: The skill does not currently implement explicit boundary markers or instruction-ignoring warnings when processing or displaying metadata from downloaded skills.
Capability inventory: The skill has capabilities including file system writes (shutil.copytree), network access (urllib.request), and system command execution (subprocess.run).
Sanitization: Implements _safe_extract_zip to prevent directory traversal (ZipSlip) and uses _validate_relative_path to ensure skill installation is restricted to the intended local directory.

skill-installer