The Agent Skills Directory

External Repository Interactions: The skill performs network operations to fetch data from GitHub using both the GitHub API and direct downloads from codeload.github.com. These operations are used to list available skills and download repository content. The logic includes fallback mechanisms for private repositories using local git credentials or environment-provided tokens.
Subprocess Command Execution: The scripts/install-skill-from-github.py script uses subprocess.run() to execute git commands, including git clone, git sparse-checkout, and git checkout. These commands are used to implement the sparse checkout installation method when direct downloads are unavailable or insufficient.
Archive Security Measures: The installation script includes a _safe_extract_zip function that implements path validation to ensure that files within downloaded ZIP archives are not extracted outside the intended destination directory, providing protection against zip-slip style vulnerabilities.
Skill Path Validation: The skill implements validation for both the source paths within a repository and the destination skill names. It checks for directory traversal patterns (e.g., ..) and ensures that skill names are single path segments, which helps prevent unauthorized file system writes.

skill-installer