The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill retrieves sensitive environment variables GITHUB_TOKEN and GH_TOKEN from the host system to authenticate with the GitHub API. These tokens are transmitted as Authorization headers in network requests, which is a high-privilege operation involving sensitive credential handling.
[REMOTE_CODE_EXECUTION]: The skill's primary function is to download external code (agent skills) from GitHub and install it into the agent's active skills directory. This creates a vector where untrusted third-party code can be introduced and executed within the agent's environment.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute git commands. While it uses list-based arguments to mitigate basic shell injection, the parameters for these commands (such as repository URLs, paths, and branch references) are derived directly from external user-supplied inputs and URLs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub repositories, including skill metadata and directory listings. Maliciously crafted filenames or repository content could influence the agent's behavior during the discovery and installation process.
Ingestion points: The scripts list-curated-skills.py and install-skill-from-github.py fetch data from the GitHub API and repository downloads.
Boundary markers: The skill does not implement delimiters or safety instructions to prevent the agent from following natural language commands found within the external content it processes.
Capability inventory: The skill possesses significant capabilities, including network access (urllib.request), file system modification (shutil.copytree), and system command execution (subprocess.run).
Sanitization: The skill includes basic security hygiene such as _safe_extract_zip to prevent path traversal (ZipSlip) and filename validation to ensure installed skills stay within their intended directory.

skill-installer