skill-installer

SUSPICIOUS: the skill’s behavior is mostly aligned with its stated purpose and uses official GitHub/OpenAI sources by default, but it is a transitive installer that can fetch and install arbitrary third-party skills from mutable GitHub refs into the agent’s skill directory. The main risk is trust expansion to unreviewed downstream skills, not confirmed malicious behavior in this installer itself.

This module appears to be a functional GitHub-based installer that fetches and installs arbitrary repository content chosen by user input. It does not show overt malware behavior (no exfiltration, credential theft, or hidden execution) within the provided code. The security risk is mainly supply-chain and operational: it executes git based on user-controlled ref/paths, downloads and extracts third-party ZIP archives, and then copies untrusted directories into the local filesystem after only minimal validation (SKILL.md presence). ZIP extraction includes a basic boundary check against path traversal, but additional archive safety (symlink/hardlink/resource exhaustion) and stronger integrity verification (commit pinning/signatures/hashes) are not evident in this module.