The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes git commands via subprocess.run to clone and manage repositories. It correctly uses list-based arguments to prevent shell injection and includes validation for paths and skill names to ensure they stay within intended boundaries.
[EXTERNAL_DOWNLOADS]: Fetches skill archives and repository data from GitHub (github.com, codeload.github.com, api.github.com). The default configuration targets the openai/skills repository for curated content.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves folder names from remote GitHub repositories and displays them to the user. This creates a surface where a maliciously named folder could attempt to inject instructions into the agent's context during the listing process.
Ingestion points: scripts/list-skills.py retrieves directory names from the GitHub Contents API.
Boundary markers: The output is presented as a numbered list without specific separators or instructions to treat the names as untrusted data.
Capability inventory: The skill has the ability to write to the local filesystem (~/.codex/skills) and execute git commands.
Sanitization: No sanitization or escaping is performed on the names fetched from the API before they are printed.
[METADATA_POISONING]: The metadata in SKILL.md identifies the author as 'OpenAI', while the skill distribution is attributed to 'jetbrains'. The skill correctly links to the original OpenAI repository as its source, suggesting it is a packaged version of the original tool.

skill-installer