skill-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow fetches curated skill listings from the public GitHub repo https://github.com/openai/skills/tree/main/skills/.curated (outsider-authored web content via GitHub API) and/or downloads skill files from user-specified GitHub repos, which can include free-form text that the installer then ingests into the agent’s skill context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer fetches skill content at runtime from GitHub (e.g. https://github.com/openai/skills/tree/main/skills/.curated and the install URL pattern https://github.com///tree//), and those downloaded skills become agent behaviors/instructions when installed, so remote content can directly control prompts or introduce executable code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The installer instructs the agent to "request escalation" to run networked scripts in the sandbox (i.e., seek elevated privileges) and can overwrite files in the user's skill directory and use credentials, which encourages privilege escalation and state changes on the host.