The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to download and install executable scripts and configuration files from external GitHub repositories into the agent's local environment paths (e.g., ~/.codex/skills or ~/.claude/skills).
[EXTERNAL_DOWNLOADS]: The installer fetches repository content from GitHub through direct ZIP archive downloads from codeload.github.com and repository cloning via git.
[COMMAND_EXECUTION]: The script scripts/install-skill-from-github.py uses the subprocess module to execute git binary commands for handling sparse checkouts and branch selection.
[INDIRECT_PROMPT_INJECTION]: As an installer, the skill provides an attack surface where malicious instructions embedded in remote repositories can be ingested into the agent's environment.
Ingestion points: scripts/install-skill-from-github.py fetches external archives and repository data from user-provided URLs.
Boundary markers: None identified; the skill assumes the content fetched at the destination is a legitimate and safe skill.
Capability inventory: scripts/install-skill-from-github.py (subprocess.run, shutil.copytree) and scripts/github_utils.py (urllib.request).
Sanitization: Implements directory traversal validation in _safe_extract_zip to prevent files from being written outside the intended destination directory.
[CREDENTIALS_UNSAFE]: The helper module scripts/github_utils.py is configured to read GITHUB_TOKEN or GH_TOKEN from the environment to facilitate authenticated API requests to GitHub. While this aligns with standard secret management practices for developer tools, it involves the handling of sensitive credentials.

skill-installer