The Agent Skills Directory

[COMMAND_EXECUTION]: The buildInstallCmd function in scripts/install-skill.js fails to properly sanitize or escape the skillName and url parameters before interpolating them into a shell command string. A maliciously crafted skill list file containing metacharacters (e.g., ;, &, |) in a skill name could lead to arbitrary shell command execution when the manager attempts to install or update that entry.
[REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of arbitrary code from external sources. It implements a self-update mechanism fetching from the author's repository and a bulk installation workflow that pulls from a wide variety of unverified third-party GitHub accounts. The 'Manual Download' fallback directly writes remote file content to the local agent skills directory (~/.agents/skills/), bypassing potential CLI guardrails.
[DYNAMIC_EXECUTION]: The skill makes extensive use of child_process.execSync to run shell commands (like npx skills and git) and perform file operations based on external inputs from the skill list files. This creates a large attack surface for potential exploitation if the input data is compromised.
[EXTERNAL_DOWNLOADS]: The skill fetches code and configuration from multiple external domains, including api.github.com and raw.githubusercontent.com. While many sources like anthropics and vercel-labs are well-known, others are individual user repositories with unknown security standards.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external markdown files (e.g., Reasonix-skill-list-v2.md or user-provided lists) to drive its core installation and update logic.
Ingestion points: Reads skill names, URLs, and installation commands from local or remote markdown files.
Boundary markers: None present; the skill treats all parsed data from the list as authoritative instructions.
Capability inventory: Includes shell command execution (execSync), writing files to agent directories, and network access to retrieve remote code.
Sanitization: The skill uses regex for basic parsing but lacks robust sanitization or validation of the commands it assembles, making it vulnerable to malicious data embedded in the list files.

skill-install-manager