The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary function is to download and install external code (other skills) into the agent's environment. While it defaults to trusted repositories, it allows for the installation of code from arbitrary, user-specified GitHub repositories, which could contain malicious logic that then persists in the agent's runtime environment.
[EXTERNAL_DOWNLOADS]: The utility scripts download content from codeload.github.com (ZIP archives) and use git to clone repositories. This functionality fetches code from external sources that are not under the control of the skill itself, creating a supply chain risk if the target repositories are compromised or malicious.
[COMMAND_EXECUTION]: The scripts/install-skill-from-github.py script executes the git command-line tool via subprocess.run. Although it uses structured argument lists to prevent shell injection, the execution of commands that interact with remote servers to download code is a high-privilege operation.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It fetches and displays folder names and metadata from remote GitHub repositories (via scripts/list-skills.py). If a malicious repository contains folder names or file content designed as LLM instructions, it could influence the agent's behavior when listing or describing available skills.
Ingestion points: GitHub API contents listings in scripts/list-skills.py and scripts/github_utils.py.
Boundary markers: The skill provides a template for listing skills but does not explicitly instruct the agent to ignore instructions embedded in the skill names themselves.
Capability inventory: File system write access (shutil.copytree), network access (urllib.request), and command execution (git).
Sanitization: The skill performs path validation to prevent directory traversal but does not sanitize the content of strings displayed to the agent during the listing process.

skill-installer