The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates downloading content from GitHub. While it defaults to the trusted openai organization, it allows users to specify any repository or URL, including untrusted sources.
[REMOTE_CODE_EXECUTION]: By downloading and placing external files into the $CODEX_HOME/skills directory, the skill prepares code for future execution by the agent. This represents a significant risk as it allows for the introduction of arbitrary remote code into the agent's execution path.
[COMMAND_EXECUTION]: The skill relies on local Python scripts (scripts/list-skills.py and scripts/install-skill-from-github.py) to manage file system operations and network requests. The ability to overwrite existing '.system' skills as mentioned in the notes further escalates this risk.
[CREDENTIALS_UNSAFE]: The documentation references the use of GITHUB_TOKEN and GH_TOKEN for private repository access. There is a risk that these credentials could be exposed or misused if the underlying scripts do not handle them securely.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes untrusted data from external repositories.
Ingestion points: External content is fetched from GitHub via the GitHub API and git sparse checkout commands.
Boundary markers: No delimiters or safety instructions are defined to separate untrusted external content from the agent's core instructions.
Capability inventory: The skill has file-write permissions to critical directories ($CODEX_HOME/skills), network access, and the ability to execute subprocesses.
Sanitization: There is no indication of content sanitization or validation before the downloaded files are written to the local system.

skill-installer