The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to fetch content from remote sources using urllib.request and git clone.
Evidence found in scripts/download_from_archive.py using urllib.request.urlopen for arbitrary URLs.
Evidence found in scripts/download_from_github.py using git clone to retrieve remote repositories.
[COMMAND_EXECUTION]: The skill executes system commands to handle Git operations.
Evidence found in scripts/download_from_github.py using subprocess.run to call git clone and git sparse-checkout.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it ingests untrusted data from the internet (GitHub, external archives) and installs it as executable instructions for the agent.
Ingestion points: Remote archives (ZIP, TAR.GZ), remote URLs, and GitHub repositories identified in scripts/download_skill.py.
Boundary markers: None identified in the source code; the skill trusts that the downloaded SKILL.md is safe after checking for the existence of name and description fields.
Capability inventory: The skill has the capability to write to the local filesystem (shutil.copytree, shutil.copyfileobj) and execute shell commands (subprocess.run).
Sanitization: There is no evidence of sanitization or deep security scanning of the downloaded skill content beyond checking YAML frontmatter validity in validate_skill_md.

skill-downloader