The Agent Skills Directory

External Code Installation: The skill's primary function is to fetch and install content from GitHub repositories. It interacts with well-known services (github.com and api.github.com) to download skill files, which is expected behavior for a package manager utility.
Command Execution: The installation script utilizes the subprocess module to perform Git operations such as cloning and checking out repositories. It correctly passes arguments as lists rather than strings, which follows security best practices to prevent shell injection vulnerabilities.
Path Traversal Protection: The skill includes a _safe_extract_zip function that validates filenames within downloaded archives to ensure they do not attempt to write files outside of the intended destination directory.
Secure Credential Handling: The skill supports authenticated requests using GITHUB_TOKEN or GH_TOKEN environment variables. This is a standard and secure way to handle API credentials without hardcoding secrets in the source code.
Input Validation: User-provided repository paths are validated to ensure they are relative and do not contain parent directory references (..), reducing the risk of unauthorized file system access during the installation process.

skill-installer