Security risk report for @forgecat/openai_skills_system-skill-installer v0.0.12
Source Integrity
Low
Profile claims authorship by OpenAI with reference to https://github.com/openai/skills, a legitimate public repository.
No evidence of typosquatted dependencies, attacker-controlled package names, or supply-chain poisoning in the declared content.
Agent Intent
INT-000Medium
The skill explicitly instructs the agent to install arbitrary code from any GitHub repository, including private repos, which enables installation of unvetted or attacker-controlled skills into the agent's runtime environment.
The instruction 'request escalation when running them' for network-using scripts in a sandbox context nudges the agent to seek elevated permissions beyond its default scope.
No direct credential exfiltration, role-hijacking, or system-prompt leakage instructions are present, keeping this below high; however, the open-ended 'install from another repo' capability is a meaningful manipulation surface.
Details
Evidence
"Install from another repo when the user provides a GitHub repo/path (including private repos)."
"All of these scripts use network, so when running in the sandbox, request escalation when running them."
Profile grants unrestricted network access (web_fetch) to arbitrary GitHub repositories without scope limits or allowlist validation.
Implicitly demands file_write authority to install skills into $CODEX_HOME/skills, with no restrictions on destination paths or file types.
Scripts are documented to require escalation in sandboxed environments, indicating awareness of privilege elevation but no explicit safeguards against malicious skill payloads.
Details
Evidence
"Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path."
"All of these scripts use network, so when running in the sandbox, request escalation when running them."
"Installs into $CODEX_HOME/skills/<skill-name> (defaults to ~/.codex/skills)."
MCP Risk
Low
No MCP servers are declared in the profile.
The skill-installer itself is a Codex skill, not an MCP server definition, so MCP-specific risks do not apply.
Details
Evidence
Profile metadata lists "Dependencies: None" and no MCP server configurations are present.
ForgeCat