The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Downloads skill configuration and archives from GitHub, a well-known service, using the GitHub API and direct ZIP download URLs. These operations are intended for fetching skill content and use official infrastructure.
[COMMAND_EXECUTION]: Uses subprocess.run to perform git clone and git checkout operations for sparse checkouts. The skill passes arguments as a list without a shell and performs validation on owner and repository strings to prevent command injection.
[REMOTE_CODE_EXECUTION]: The skill is designed to install executable content (other skills) into the agent's environment. It mitigates risks by implementing 'ZipSlip' protection (validating that extracted files do not escape the destination directory) and ensuring that the installed content contains a valid SKILL.md file before placement.

skill-installer