skill-installer
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data and executable content from remote GitHub repositories. It defaults to OpenAI's official skills repository but supports arbitrary URLs provided by the user.
- [REMOTE_CODE_EXECUTION]: The core functionality of the skill is to download and install executable code (skills) from the internet into the local skill directory. These installed components are subsequently picked up and executed by the agent environment.
- [COMMAND_EXECUTION]: The skill utilizes local Python scripts (
scripts/list-curated-skills.py,scripts/install-skill-from-github.py) to perform network requests, file system operations, and skill management. The documentation explicitly notes that these scripts require permission escalation in sandbox environments. - [CREDENTIALS_UNSAFE]: The skill instructions specify support for
GITHUB_TOKENandGH_TOKENenvironment variables to access private repositories. This pattern encourages the management and potential exposure of sensitive authentication credentials within the agent's runtime context. - [DATA_EXFILTRATION]: Because the skill has the ability to read local directories, write to the file system, and communicate with arbitrary GitHub repositories, it possesses the necessary primitives for data exfiltration if directed to a malicious repository.
Audit Metadata