lythoskill-curator
Indexes and catalogs skills from local directories, providing structured data for querying without modifying or recommending skills.
Install this skill
or
12/100
Security score
The lythoskill-curator skill was audited on Oct 31, 2026 and we found 14 security issues across 4 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
critical line 172
Piping content to bash shell
SourceSKILL.md
| 170 | > `gh` CLI is required for precise skill discovery. Install it: |
| 171 | > - macOS: `brew install gh` |
| 172 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 173 | > - Then: `gh auth login` |
| 174 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
low line 167
Command substitution pattern
SourceSKILL.md
| 165 | `GITHUB_TOKEN` / `GH_TOKEN` env vars. If found, export it: |
| 166 | ```bash |
| 167 | export GH_TOKEN=$(cat .github-token) |
| 168 | ``` |
| 169 | 2. **Ask the user to install gh**: if `gh` CLI is missing entirely, tell the user: |
medium line 174
Command substitution pattern
SourceSKILL.md
| 172 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 173 | > - Then: `gh auth login` |
| 174 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
| 175 | 3. **Ask for a token**: if gh is installed but not authed: |
| 176 | > `gh` needs a GitHub token. You can: |
medium line 478
Command substitution pattern
SourceSKILL.md
| 476 | is agent-side. See ADR-20260508230803515. |
| 477 | |
| 478 | **Shell batch gotcha**: `$(bun ... 2>/dev/null)` in a loop corrupts PATH on subsequent |
| 479 | iterations. For batch operations (bulk find, bulk tag), use SQLite directly via |
| 480 | `curator query` or a Bun/Node script reading catalog.db. Single commands are safe. |
high line 172
Curl to non-GitHub URL
SourceSKILL.md
| 170 | > `gh` CLI is required for precise skill discovery. Install it: |
| 171 | > - macOS: `brew install gh` |
| 172 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 173 | > - Then: `gh auth login` |
| 174 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
medium line 29
Access to home directory dotfiles
SourceSKILL.md
| 27 | # ── deck governance metadata (consumed by lythoskill tooling only) ── |
| 28 | deck_managed_dirs: |
| 29 | - ~/.agents/skill-repos/.lythoskill-curator/ |
| 30 | --- |
| 31 |
low line 188
Access to home directory dotfiles
SourceSKILL.md
| 186 | ```bash |
| 187 | bunx @lythos/[email protected] [POOL_PATH] |
| 188 | # Defaults: POOL_PATH = ~/.agents/skill-repos |
| 189 | # Output = <pool>/.lythoskill-curator/ |
| 190 | bunx @lythos/[email protected] ~/.agents/skill-repos --output /tmp/my-index/ |
low line 190
Access to home directory dotfiles
SourceSKILL.md
| 188 | # Defaults: POOL_PATH = ~/.agents/skill-repos |
| 189 | # Output = <pool>/.lythoskill-curator/ |
| 190 | bunx @lythos/[email protected] ~/.agents/skill-repos --output /tmp/my-index/ |
| 191 | ``` |
| 192 | Reconciler-style: converges any state to a clean index. Auto-backup before rebuild. |
low line 311
Access to home directory dotfiles
SourceSKILL.md
| 309 | To add it: |
| 310 | 1. gh search code "fullstack-dev" --filename "SKILL.md" ← find the repo |
| 311 | 2. curator add github.com/<owner>/<repo> --pool ~/.agents/skill-repos |
| 312 | 3. curator find fullstack-dev # then it will hit |
| 313 |
low line 351
Access to home directory dotfiles
SourceSKILL.md
| 349 | ### Add a skill to the cold pool |
| 350 | ```bash |
| 351 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 352 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 353 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
low line 352
Access to home directory dotfiles
SourceSKILL.md
| 350 | ```bash |
| 351 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 352 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 353 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 354 | --output /tmp/my-index/ |
low line 353
Access to home directory dotfiles
SourceSKILL.md
| 351 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 352 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 353 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 354 | --output /tmp/my-index/ |
| 355 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
low line 355
Access to home directory dotfiles
SourceSKILL.md
| 353 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 354 | --output /tmp/my-index/ |
| 355 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 356 | --reason "Found via WebSearch for code review skills" --branch main |
| 357 | ``` |
critical line 172
Curl pipe to interpreter
SourceSKILL.md
| 170 | > `gh` CLI is required for precise skill discovery. Install it: |
| 171 | > - macOS: `brew install gh` |
| 172 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 173 | > - Then: `gh auth login` |
| 174 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
Scanned on Oct 31, 2026
View Security Dashboard