The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The install_skill function in scripts/install_skill.py is vulnerable to path traversal. It uses a skill_name derived directly from the name field in a skill's SKILL.md frontmatter to construct the installation path (e.g., ~/.claude/skills/{name}). The lack of validation for directory traversal sequences like .. allows a maliciously named skill to be installed into arbitrary sensitive locations, such as ~/.ssh, potentially overwriting critical system or identity files.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to fetch and install skills from a remote catalog API. The download_from_catalog function in scripts/install_skill.py uses the requests library to download file content and write it directly to the local filesystem, introducing significant risk from untrusted remote sources.
[REMOTE_CODE_EXECUTION]: By downloading external skill code and placing it in active skill directories for various AI harnesses, the installer facilitates the remote execution of untrusted code. The download mechanism lacks robust integrity checks or signature verification for the incoming content.
[COMMAND_EXECUTION]: The script performs high-impact file system operations, including recursive directory copying (shutil.copytree) and deletion (shutil.rmtree). These operations target persistent configuration directories for various AI agent harnesses (e.g., ~/.claude, ~/.config/goose).
[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing engine for untrusted external skill data, creating a vulnerability surface where a malicious skill can leverage the installer's capabilities for unauthorized writes.
Ingestion points: Frontmatter parsing of SKILL.md in the get_skill_name function within scripts/install_skill.py.
Boundary markers: Absent; the script trusts the name field in the frontmatter without verification.
Capability inventory: Recursive file writing, directory removal, and external network requests via requests.get.
Sanitization: Absent; no path validation or sanitization is performed on the extracted skill_name to prevent traversal.
[DYNAMIC_EXECUTION]: The script dynamically modifies the Python search path (sys.path) at runtime to import shared modules (agentskills_config) from a parent directory structure, enabling the execution of code from outside the skill's own package scope.

skill-installer