lythoskill-curator
Indexes and catalogs skills from local directories, providing structured data for querying without modifying or recommending skills.
Install this skill
or
12/100
Security score
The lythoskill-curator skill was audited on Jul 31, 2026 and we found 14 security issues across 4 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
critical line 159
Piping content to bash shell
SourceSKILL.md
| 157 | > `gh` CLI is required for precise skill discovery. Install it: |
| 158 | > - macOS: `brew install gh` |
| 159 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 160 | > - Then: `gh auth login` |
| 161 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
low line 154
Command substitution pattern
SourceSKILL.md
| 152 | `GITHUB_TOKEN` / `GH_TOKEN` env vars. If found, export it: |
| 153 | ```bash |
| 154 | export GH_TOKEN=$(cat .github-token) |
| 155 | ``` |
| 156 | 2. **Ask the user to install gh**: if `gh` CLI is missing entirely, tell the user: |
medium line 161
Command substitution pattern
SourceSKILL.md
| 159 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 160 | > - Then: `gh auth login` |
| 161 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
| 162 | 3. **Ask for a token**: if gh is installed but not authed: |
| 163 | > `gh` needs a GitHub token. You can: |
medium line 462
Command substitution pattern
SourceSKILL.md
| 460 | is agent-side. See ADR-20260508230803515. |
| 461 | |
| 462 | **Shell batch gotcha**: `$(bun ... 2>/dev/null)` in a loop corrupts PATH on subsequent |
| 463 | iterations. For batch operations (bulk find, bulk tag), use SQLite directly via |
| 464 | `curator query` or a Bun/Node script reading catalog.db. Single commands are safe. |
high line 159
Curl to non-GitHub URL
SourceSKILL.md
| 157 | > `gh` CLI is required for precise skill discovery. Install it: |
| 158 | > - macOS: `brew install gh` |
| 159 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 160 | > - Then: `gh auth login` |
| 161 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
medium line 29
Access to home directory dotfiles
SourceSKILL.md
| 27 | # ── deck governance metadata (consumed by lythoskill tooling only) ── |
| 28 | deck_managed_dirs: |
| 29 | - ~/.agents/skill-repos/.lythoskill-curator/ |
| 30 | --- |
| 31 |
low line 175
Access to home directory dotfiles
SourceSKILL.md
| 173 | ```bash |
| 174 | bunx @lythos/[email protected] [POOL_PATH] |
| 175 | # Defaults: POOL_PATH = ~/.agents/skill-repos |
| 176 | # Output = <pool>/.lythoskill-curator/ |
| 177 | bunx @lythos/[email protected] ~/.agents/skill-repos --output /tmp/my-index/ |
low line 177
Access to home directory dotfiles
SourceSKILL.md
| 175 | # Defaults: POOL_PATH = ~/.agents/skill-repos |
| 176 | # Output = <pool>/.lythoskill-curator/ |
| 177 | bunx @lythos/[email protected] ~/.agents/skill-repos --output /tmp/my-index/ |
| 178 | ``` |
| 179 | Reconciler-style: converges any state to a clean index. Auto-backup before rebuild. |
low line 295
Access to home directory dotfiles
SourceSKILL.md
| 293 | To add it: |
| 294 | 1. gh search code "fullstack-dev" --filename "SKILL.md" ← find the repo |
| 295 | 2. curator add github.com/<owner>/<repo> --pool ~/.agents/skill-repos |
| 296 | 3. curator find fullstack-dev # then it will hit |
| 297 |
low line 335
Access to home directory dotfiles
SourceSKILL.md
| 333 | ### Add a skill to the cold pool |
| 334 | ```bash |
| 335 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 336 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 337 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
low line 336
Access to home directory dotfiles
SourceSKILL.md
| 334 | ```bash |
| 335 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 336 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 337 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 338 | --output /tmp/my-index/ |
low line 337
Access to home directory dotfiles
SourceSKILL.md
| 335 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 336 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 337 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 338 | --output /tmp/my-index/ |
| 339 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
low line 339
Access to home directory dotfiles
SourceSKILL.md
| 337 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 338 | --output /tmp/my-index/ |
| 339 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 340 | --reason "Found via WebSearch for code review skills" --branch main |
| 341 | ``` |
critical line 159
Curl pipe to interpreter
SourceSKILL.md
| 157 | > `gh` CLI is required for precise skill discovery. Install it: |
| 158 | > - macOS: `brew install gh` |
| 159 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 160 | > - Then: `gh auth login` |
| 161 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
Scanned on Jul 31, 2026
View Security Dashboard