The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to download and install executable code (AI skills) from arbitrary external GitHub repositories into the $CODEX_HOME/skills directory. This behavior allows for the introduction of untrusted code into the agent's environment, which is then executed by the host application upon restart.
[EXTERNAL_DOWNLOADS]: Fetches curated skill definitions from OpenAI's official GitHub repository. However, the skill also supports downloading scripts and data from any user-provided GitHub repository, which could host malicious payloads.
[COMMAND_EXECUTION]: The skill executes Python scripts (scripts/list-curated-skills.py and scripts/install-skill-from-github.py) to manage installations. These scripts perform network requests and write to the local file system, and the instructions explicitly note the need for permission escalation when running in restricted environments.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests and processes untrusted data from external repositories.
Ingestion points: External GitHub repositories (referenced in SKILL.md and scripts).
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore potential commands within the downloaded content.
Capability inventory: Uses Python scripts with network access and file system write permissions to install content into an executable path.
Sanitization: Absent; there is no evidence of validation or sanitization for the content being pulled from external sources.

skill-installer