skill-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill installer explicitly fetches listings from and installs code from GitHub (e.g., the curated list at https://github.com/openai/skills/tree/main/skills/.curated via the GitHub API and arbitrary repos/paths via scripts/install-skill-from-github.py), so it ingests untrusted, user-provided third-party repository content which can materially alter agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer fetches and installs Codex skills at runtime from GitHub (e.g. https://github.com/openai/skills/tree/main/skills/.curated and arbitrary repo URLs like https://github.com///tree// or git@github.com:/.git), and those fetched skill files directly modify the agent's capabilities/prompts (and could contain executable code), so this is a runtime external dependency that controls agent behavior.