awesome-codex-skills-curator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches modular instruction sets (skills) from GitHub repositories.\n
- Evidence: git clone https://github.com/ComposioHQ/awesome-codex-skills.git\n- [REMOTE_CODE_EXECUTION]: Downloads and executes Python scripts from a remote repository to facilitate installation.\n
- Evidence: python skill-installer/scripts/install-skill-from-github.py\n- [COMMAND_EXECUTION]: Utilizes subprocess.run and CLI calls to git and python to manage skill lifecycle.\n
- Evidence: Uses subprocess.run to call the installer script and shell commands to copy files.\n- [INDIRECT_PROMPT_INJECTION]: Provides a mechanism to download and install executable skills from arbitrary GitHub repositories, creating an attack surface for untrusted code execution.\n
- Evidence: Support for --repo and --path arguments allows installation from any provided GitHub repository URL.
Audit Metadata