repo-skill-installer
Warn
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's primary workflow involves fetching content from remote sources, specifically targeting GitHub repositories and
skills.shURLs to install them locally. - [REMOTE_CODE_EXECUTION]: By downloading and placing executable skill components into the
.agents/skillsdirectory, the skill facilitates the execution of remote code. The instructions specifically mention resolving and copying scripts from external origins, which can lead to the execution of untrusted logic. - [PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by processing external, unverified data that may contain malicious instructions.
- Ingestion points: External repositories and
skills.shURLs are ingested into the local repository context. - Boundary markers: No explicit markers or delimiters are used to isolate or ignore instructions contained within the downloaded content.
- Capability inventory: The skill possesses the capability to write files to the local directory
.agents/skills/and modify repository configuration files includingskills.sources.jsonandskills-lock.json. - Sanitization: There is no evidence of sanitization or integrity verification for the remote content before it is integrated into the system.
Audit Metadata