Skills skill-installer

📦

skill-installer

Name: skill-installer
Author: openai

Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands📁 Filesystem access

Install Codex Skills from GitHub

Finding and installing compatible skills manually takes time and risks incorrect placement. This skill lists available packages and installs selected GitHub skills into the configured Codex directory.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "skill-installer" from https://skillstore.io/skills/skill-installer.md and its manifest at https://skillstore.io/api/skills/skill-installer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/skill-installer.md Signed manifest GET /api/skills/skill-installer/manifest Signed lockfile GET /api/skills/skill-installer/lockfile

Test it

Using "skill-installer". List curated skills and show which packages are already installed.

Expected outcome:

Available: spreadsheets
Available: document-tools
Already installed: imagegen

Using "skill-installer". Install the selected skill from its GitHub repository path.

Expected outcome:

Installed document-tools to the configured Codex skills directory.

Using "skill-installer". Install an internal skill from a private GitHub repository.

Expected outcome:

Installed internal-tools after authenticated GitHub access completed successfully.

Security Audit

High Risk

v9 • 8/17/2026 Open versioned report

The skill intentionally uses GitHub networking, optional tokens, Git subprocesses, and filesystem writes to install skills. Most Markdown, SVG, path-string, and guarded archive findings are false positives. Arbitrary remote skill content is copied into the active skills directory without trust verification, creating a supply-chain risk.

Files scanned

711

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:14-17 scripts/install-skill-from-github.py:164-176 scripts/install-skill-from-github.py:269-295

Unreviewed Remote Skill Installation

The installer copies arbitrary GitHub skill content into the active skills directory after checking only for SKILL.md. It does not verify publisher trust, signatures, or content safety.

The validation and copy flow is explicit, and no trust or content-review control exists.

Medium

scripts/github_utils.py:15-17 scripts/install-skill-from-github.py:80-112

Unbounded Download and Archive Extraction

The HTTP helper reads complete responses into memory, and archive extraction has no size or file-count limits. Large repositories can exhaust memory or disk.

The response is buffered without a cap, and extraction performs no quota checks.

Capability review items (34)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/github_utils.py:12

Git platform tokens

token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")

The code intentionally reads a documented environment variable for configuration or GitHub authentication.

High

scripts/install-skill-from-github.py:100

Python subprocess.run

result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)

The installer intentionally invokes Git with an argument list and without a shell.

High

scripts/install-skill-from-github.py:46

Hidden file in home directory

return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

The code intentionally reads or modifies local paths while listing or installing skills.

High

scripts/list-skills.py:35

Hidden file in home directory

return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:46

Hidden file access

return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:87

Python file write/append

with open(zip_path, "wb") as file_handle:

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:176

Python shutil operations

shutil.copytree(src, dest_dir)

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:298

Python shutil operations

shutil.rmtree(tmp_dir, ignore_errors=True)

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:51

Python os file operations

os.makedirs(base, exist_ok=True)

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:173

Python os file operations

os.makedirs(os.path.dirname(dest_dir), exist_ok=True)

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:15

Python archive libraries

import zipfile

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:89

Python archive libraries

with zipfile.ZipFile(zip_path, "r") as zip_file:

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/install-skill-from-github.py:105

Python archive libraries

def _safe_extract_zip(zip_file: zipfile.ZipFile, dest_dir: str) -> None:

The code intentionally reads or modifies local paths while listing or installing skills.

Medium

scripts/list-skills.py:35

Hidden file access

return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

The code intentionally reads or modifies local paths while listing or installing skills.

Low

scripts/github_utils.py:10

HTTP client library

def github_request(url: str, user_agent: str) -> bytes:

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/github_utils.py:7

Python HTTP libraries

import urllib.request

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/github_utils.py:15

Python HTTP libraries

req = urllib.request.Request(url, headers=headers)

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/github_utils.py:16

Python HTTP libraries

with urllib.request.urlopen(req) as resp:

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/github_utils.py:21

Hardcoded URL

return f"https://api.github.com/repos/{repo}/contents/{path}?ref={ref}"

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/github_utils.py:12

Python environment access

token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")

The code intentionally reads a documented environment variable for configuration or GitHub authentication.

Low

scripts/install-skill-from-github.py:55

HTTP client library

def _request(url: str) -> bytes:

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/install-skill-from-github.py:56

HTTP client library

return github_request(url, "codex-skill-install")

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/install-skill-from-github.py:84

HTTP client library

payload = _request(zip_url)

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/install-skill-from-github.py:81

Hardcoded URL

zip_url = f"https://codeload.github.com/{owner}/{repo}/zip/{ref}"

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/install-skill-from-github.py:180

Hardcoded URL

return f"https://github.com/{owner}/{repo}.git"

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/install-skill-from-github.py:12

Temp file creation

import tempfile

The code intentionally reads or modifies local paths while listing or installing skills.

Low

scripts/install-skill-from-github.py:50

Temp file creation

base = os.path.join(tempfile.gettempdir(), "codex")

The code intentionally reads or modifies local paths while listing or installing skills.

Low

scripts/install-skill-from-github.py:279

Temp file creation

tmp_dir = tempfile.mkdtemp(prefix="skill-install-", dir=_tmp_root())

The code intentionally reads or modifies local paths while listing or installing skills.

Low

scripts/install-skill-from-github.py:46

Python environment access

return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

The code intentionally reads a documented environment variable for configuration or GitHub authentication.

Low

scripts/list-skills.py:30

HTTP client library

def _request(url: str) -> bytes:

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/list-skills.py:31

HTTP client library

return github_request(url, "codex-skill-list")

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/list-skills.py:53

HTTP client library

payload = _request(api_url)

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/list-skills.py:58

Hardcoded URL

f"https://github.com/{repo}/tree/{ref}/{path}"

The code intentionally contacts GitHub to list or download skill content.

Low

scripts/list-skills.py:35

Python environment access

return os.environ.get("CODEX_HOME", os.path.expanduser("~/.codex"))

The code intentionally reads a documented environment variable for configuration or GitHub authentication.

Risk Factors

🌐 Network access (20)

🔑 Env variables (5)

scripts/github_utils.py:12 scripts/github_utils.py:12 scripts/install-skill-from-github.py:46 scripts/list-skills.py:35 SKILL.md:55

⚙️ External commands (15)

scripts/install-skill-from-github.py:100 SKILL.md:13 SKILL.md:21 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:54 SKILL.md:55 SKILL.md:58

📁 Filesystem access (26)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/skill-installer/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/skill-installer/security.svg)](https://skillstore.io/skills/skill-installer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/skill-installer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skill-installer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/skill-installer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

openai. (2026). skill-installer security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skill-installer/audits/9

BibTeX citation

@techreport{openai-skill-installer-2026,
  author = {openai},
  title = {skill-installer security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/skill-installer/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-installer security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/skill-installer/audits/9"
identifiers:
  - type: other
    value: "skillstore:skill-installer:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Stronger evidence confidence

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

openai Recommended Current

skill-installer

Skillstore Score 38

Evidence Confidence High

Skillstore usage 151

Updated

2026-08-21

davila7

davila7-skill-installer

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 18

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Discover curated skills

List the default curated collection and identify packages that are already installed.

Install a team skill

Install an internal skill from a private GitHub repository using existing credentials or a token.

Provision multiple skills

Install several skill folders from one repository into a custom destination.

Try These Prompts

List curated skills

List skills from the default curated collection. Mark which skills are already installed.

Install one curated skill

Install the curated skill named [skill name]. Report the installed destination.

Install from a repository

Install the skill at [repository path] from [owner/repository]. Use ref [branch, tag, or commit].

Provision pinned skills

Install skills at [first path] and [second path] from [owner/repository]. Pin ref [commit], use Git mode, and report destinations.

Best Practices

Review the repository and SKILL.md before installing any third-party skill.
Pin third-party installations to an immutable commit whenever possible.
Use a least-privileged GitHub token and remove it from the environment afterward.

Avoid

Do not install from an unknown repository based only on the skill name.
Do not use a broad GitHub token when read-only repository access is sufficient.
Do not bypass an existing destination error without reviewing the installed copy.