Skills open-skills

📦

open-skills

Name: open-skills
Author: lumacoder

v2.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Manage AI Skills Across Editors

AI coding teams often maintain separate skill files for each editor. open-skills provides one CLI to discover, install, sync, and manage shared skill content.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "open-skills" from https://skillstore.io/skills/lumacoder-open-skills.md and its manifest at https://skillstore.io/api/skills/lumacoder-open-skills/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/lumacoder-open-skills.md Signed manifest GET /api/skills/lumacoder-open-skills/manifest Signed lockfile GET /api/skills/lumacoder-open-skills/lockfile

Test it

Using "open-skills". Install two frontend skills into Claude Code for the current project.

Expected outcome:

The assistant opens the editor, scope, category, and skill selection flow.
It writes selected skills under the Claude Code skills directory for the selected scope.
It reports which skills succeeded and which failed.

Using "open-skills". Export my current AI skill setup.

Expected outcome:

The assistant detects installed directory-mode skills for supported editors.
It writes a stack file that can be imported later.
It explains any editor targets that cannot be detected automatically.

Using "open-skills". Create and validate a new skill scaffold.

Expected outcome:

The assistant creates a local bundle with a starter skill file.
It registers the skill metadata in the registry.
It runs registry validation and reports any missing fields.

Security Audit

High Risk

v4 • 7/6/2026 Open versioned report

Most static findings are false positives from Markdown examples, TypeScript import paths, template literals, lockfile metadata, and Unicode text. Confirmed issues are limited to trust-sensitive external network lookups, developer-panel innerHTML rendering, remote skill installation into AI editor targets, and unauthenticated local registry mutation in dev mode. No prompt injection attempt was found in the reviewed files.

Files scanned

7,200

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

src/cli.ts:19-20 src/dev-server/api.ts:7-15 src/dev-server/api.ts:46-51 src/dev-server/server.ts:55-56

Unauthenticated Developer Registry Write API

The developer server exposes state-changing registry APIs without authentication and allows all origins. If the server is reachable by untrusted browser content or network clients, registry data can be replaced.

The code directly shows dev-mode startup, wildcard CORS headers, and POST /api/registry writing parsed JSON. Exploitability depends on the dev server running and being reachable.

High

src/core/engine.ts:37-48 src/core/engine.ts:53-76 src/commands/sync.ts:39-67 src/core/adapters/claude-adapter.ts:31-43

Remote Skill Content Installed Into AI Editor Targets

The install and sync flows clone registry-controlled git sources and write transformed skill text into AI editor skill or rule locations. This is expected behavior, but unreviewed remote skill text can influence assistant behavior after installation.

The implementation clones remote origins, reads SKILL.md content, transforms it, and writes it into editor targets. Malicious impact depends on registry content and user selection.

Medium

src/core/engine.ts:24-31 src/core/adapters/claude-adapter.ts:31-37 src/core/adapters/base-adapter.ts:1-37

Managed Directory Cleanup Before Install

Directory-mode installs call cleanup on the computed editor target before generating output. This can remove files inside managed skill directories when users keep manual files there.

The engine calls cleanDirectory for directory adapters before writing outputs, and adapter code writes into computed target paths. The precise removal logic is in a helper not included in static findings, so confidence is moderate.

Medium

src/commands/create.ts:15-16 src/commands/create.ts:68-77 src/commands/create.ts:95-100

Create Command Allows Positional Path Traversal

The interactive create flow validates prompted names, but a positional CLI name is accepted before path construction. A local user can pass traversal segments and create files outside the intended bundles directory.

The code validates only the prompted name path and then joins the resulting name into bundles/skills. The issue requires local CLI input, which limits severity.

Capability review items (21)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

src/dev-server/web/index.html:245

innerHTML assignment (XSS risk)

div.innerHTML = `<span class="cat-name">${cat.displayName}</span><span class="cat-count">${count}</s

The developer panel builds HTML from registry-controlled category, skill, or tag values without escaping. A malicious registry entry could execute script in the local panel.

Medium

src/dev-server/web/index.html:275

innerHTML assignment (XSS risk)

content.innerHTML = `<table><thead><tr><th>名称</th><th>描述</th><th>源</th><th>Tags</th><th>操作</th></tr>

The developer panel builds HTML from registry-controlled category, skill, or tag values without escaping. A malicious registry entry could execute script in the local panel.

Medium

src/dev-server/web/index.html:358

innerHTML assignment (XSS risk)

document.getElementById('skillCategory').innerHTML = this.data.categories.map((c) => `<option value=

The developer panel builds HTML from registry-controlled category, skill, or tag values without escaping. A malicious registry entry could execute script in the local panel.

Low

registry/skills.json:89

Hardcoded URL

"url": "https://github.com/forrestchang/andrej-karpathy-skills.git"

This URL is used as a remote skill or git origin that can be fetched by the CLI. It is expected behavior, but users should review remote content before install.

Low

src/commands/sync.ts:40

Hardcoded URL

? `https://github.com/${skill.origin.ref}.git`

This URL is used as a remote skill or git origin that can be fetched by the CLI. It is expected behavior, but users should review remote content before install.

Low

src/core/github-utils.ts:35

Fetch API call

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/github-utils.ts:53

Fetch API call

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/github-utils.ts:82

Fetch API call

const res = await fetch(url.toString(), {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/github-utils.ts:106

Fetch API call

const res = await fetch(`https://api.github.com/search/repositories?q=${q}&per_page=${perPage}`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/github-utils.ts:35

Hardcoded URL

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/github-utils.ts:53

Hardcoded URL

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/github-utils.ts:80

Hardcoded URL

const url = new URL(`https://api.github.com/repos/${owner}/${repo}/contents/${path}`);

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/github-utils.ts:106

Hardcoded URL

const res = await fetch(`https://api.github.com/search/repositories?q=${q}&per_page=${perPage}`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/registry-v3.ts:51

Hardcoded URL

url: `https://github.com/${skill.origin.ref}.git`,

This URL is used as a remote skill or git origin that can be fetched by the CLI. It is expected behavior, but users should review remote content before install.

Low

src/core/resolvers/github-resolver.ts:14

Fetch API call

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/resolvers/github-resolver.ts:33

Fetch API call

const tagsRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/resolvers/github-resolver.ts:14

Hardcoded URL

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/resolvers/github-resolver.ts:33

Hardcoded URL

const tagsRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/resolvers/skillstore-resolver.ts:80

Fetch API call

const res = await fetch(skillStoreUrl, { headers: { 'User-Agent': 'open-skills' } });

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

Low

src/core/resolvers/skillstore-resolver.ts:71

Hardcoded URL

return `https://skillstore.io/skills/${slug}`;

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Low

src/core/resolvers/skillstore-resolver.ts:114

Hardcoded URL

if (ref.startsWith('https://github.com/')) {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

Risk Factors

⚙️ External commands (157)

🌐 Network access (42)

docs/PRD-V1.md:185 docs/PRD-V2.md:252 docs/PRD-V3.md:85 package.json:29 package.json:32 package.json:34 README.md:54 README.md:161 README.md:305 registry/_v2_backup/docker-basics.yaml:8 registry/_v2_backup/node-api-design.yaml:8 registry/_v2_backup/react-best-practices.yaml:8 registry/_v2_backup/typescript-patterns.yaml:8 registry/_v2_backup/web-security.yaml:8 registry/skills.json:64 registry/skills.json:89 registry/skills.json:107 src/commands/sync.ts:40 src/core/github-utils.ts:35 src/core/github-utils.ts:53 src/core/github-utils.ts:82 src/core/github-utils.ts:106 src/core/github-utils.ts:35 src/core/github-utils.ts:53 src/core/github-utils.ts:80 src/core/github-utils.ts:106 src/core/registry-v3.ts:51 src/core/resolvers/github-resolver.ts:14 src/core/resolvers/github-resolver.ts:33 src/core/resolvers/github-resolver.ts:14 src/core/resolvers/github-resolver.ts:33 src/core/resolvers/skillstore-resolver.ts:80 src/core/resolvers/skillstore-resolver.ts:71 src/core/resolvers/skillstore-resolver.ts:114 src/dev-server/api.ts:31 src/dev-server/server.ts:19 src/dev-server/server.ts:56 src/dev-server/web/index.html:204 src/dev-server/web/index.html:386 src/dev-server/web/index.html:444 src/dev-server/web/index.html:460 src/dev-server/web/index.html:128

📁 Filesystem access (151)

🔑 Env variables (2)

src/cli.ts:19 src/cli.ts:19

⚡ Contains scripts (7)

src/core/marker-system.ts:27 src/dev-server/web/index.html:239 src/dev-server/web/index.html:245 src/dev-server/web/index.html:256 src/dev-server/web/index.html:261 src/dev-server/web/index.html:275 src/dev-server/web/index.html:358

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/lumacoder-open-skills/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/lumacoder-open-skills/security.svg)](https://skillstore.io/skills/lumacoder-open-skills?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/lumacoder-open-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lumacoder-open-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/lumacoder-open-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

lumacoder. (2026). open-skills security audit report (audit version 4) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/lumacoder-open-skills/audits/4

BibTeX citation

@techreport{lumacoder-lumacoder-open-skills-2026,
  author = {lumacoder},
  title = {open-skills security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/lumacoder-open-skills/audits/4},
  note = {Author version 2.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "open-skills security audit report (audit version 4)"
version: "2.0.0"
type: report
authors:
  - name: "lumacoder"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/lumacoder-open-skills/audits/4"
identifiers:
  - type: other
    value: "skillstore:lumacoder-open-skills:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Standardize Team AI Editors

Install the same approved skills into several AI coding editors so contributors share consistent assistant behavior.

Maintain a Skill Registry

Create, validate, export, import, and synchronize a curated registry of reusable skills for internal workflows.

Test Cross-Editor Output

Generate editor-specific outputs for Claude Code, Cursor, Cline, Windsurf, and related tools from one skill source.

Try These Prompts

Install Selected Skills

Use open-skills to install frontend and devops skills into Claude Code and Cursor for this workspace. Explain each prompt choice before proceeding.

Find Relevant Skills

Search the open-skills registry for skills related to testing and API design. Summarize the best matches and the editors they can target.

Create a Local Skill

Create a new local skill scaffold named api-review-checklist in the backend category. Explain which files were created and how to validate it.

Audit and Sync Sources

Review the registry for remote git or GitHub origins. Identify which skills can be synchronized, then run the safest sync plan for one selected skill.

Best Practices

Review remote skill content before installing it into global editor directories.
Use local scope first when testing new skills or registry changes.
Back up existing editor rule files and skill directories before install, update, sync, or import commands.

Avoid

Do not run the developer web panel on a shared or exposed network interface.
Do not install unreviewed remote skills directly into global AI editor directories.
Do not store personal files inside managed editor skill directories.