skill-installer

SUSPICIOUS. The skill’s core function is coherent, but it is a high-risk installer because it imports remote skills into trusted agent directories and supports arbitrary GitHub/private repos. Official OpenAI curated installs look proportionate; the main concern is the transitive trust chain, credential use for private access, and later execution of untrusted skill instructions.

This module appears to be a functional GitHub-based installer that fetches and installs arbitrary repository content chosen by user input. It does not show overt malware behavior (no exfiltration, credential theft, or hidden execution) within the provided code. The security risk is mainly supply-chain and operational: it executes git based on user-controlled ref/paths, downloads and extracts third-party ZIP archives, and then copies untrusted directories into the local filesystem after only minimal validation (SKILL.md presence). ZIP extraction includes a basic boundary check against path traversal, but additional archive safety (symlink/hardlink/resource exhaustion) and stronger integrity verification (commit pinning/signatures/hashes) are not evident in this module.