lythoskill-curator
Indexes and catalogs skills from local directories, providing structured data for querying without modifying or recommending skills.
Install this skill
or
12/100
Security score
The lythoskill-curator skill was audited on Sep 11, 2026 and we found 14 security issues across 4 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
critical line 165
Piping content to bash shell
SourceSKILL.md
| 163 | > `gh` CLI is required for precise skill discovery. Install it: |
| 164 | > - macOS: `brew install gh` |
| 165 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 166 | > - Then: `gh auth login` |
| 167 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
low line 160
Command substitution pattern
SourceSKILL.md
| 158 | `GITHUB_TOKEN` / `GH_TOKEN` env vars. If found, export it: |
| 159 | ```bash |
| 160 | export GH_TOKEN=$(cat .github-token) |
| 161 | ``` |
| 162 | 2. **Ask the user to install gh**: if `gh` CLI is missing entirely, tell the user: |
medium line 167
Command substitution pattern
SourceSKILL.md
| 165 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 166 | > - Then: `gh auth login` |
| 167 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
| 168 | 3. **Ask for a token**: if gh is installed but not authed: |
| 169 | > `gh` needs a GitHub token. You can: |
medium line 471
Command substitution pattern
SourceSKILL.md
| 469 | is agent-side. See ADR-20260508230803515. |
| 470 | |
| 471 | **Shell batch gotcha**: `$(bun ... 2>/dev/null)` in a loop corrupts PATH on subsequent |
| 472 | iterations. For batch operations (bulk find, bulk tag), use SQLite directly via |
| 473 | `curator query` or a Bun/Node script reading catalog.db. Single commands are safe. |
high line 165
Curl to non-GitHub URL
SourceSKILL.md
| 163 | > `gh` CLI is required for precise skill discovery. Install it: |
| 164 | > - macOS: `brew install gh` |
| 165 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 166 | > - Then: `gh auth login` |
| 167 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
medium line 29
Access to home directory dotfiles
SourceSKILL.md
| 27 | # ── deck governance metadata (consumed by lythoskill tooling only) ── |
| 28 | deck_managed_dirs: |
| 29 | - ~/.agents/skill-repos/.lythoskill-curator/ |
| 30 | --- |
| 31 |
low line 181
Access to home directory dotfiles
SourceSKILL.md
| 179 | ```bash |
| 180 | bunx @lythos/[email protected] [POOL_PATH] |
| 181 | # Defaults: POOL_PATH = ~/.agents/skill-repos |
| 182 | # Output = <pool>/.lythoskill-curator/ |
| 183 | bunx @lythos/[email protected] ~/.agents/skill-repos --output /tmp/my-index/ |
low line 183
Access to home directory dotfiles
SourceSKILL.md
| 181 | # Defaults: POOL_PATH = ~/.agents/skill-repos |
| 182 | # Output = <pool>/.lythoskill-curator/ |
| 183 | bunx @lythos/[email protected] ~/.agents/skill-repos --output /tmp/my-index/ |
| 184 | ``` |
| 185 | Reconciler-style: converges any state to a clean index. Auto-backup before rebuild. |
low line 304
Access to home directory dotfiles
SourceSKILL.md
| 302 | To add it: |
| 303 | 1. gh search code "fullstack-dev" --filename "SKILL.md" ← find the repo |
| 304 | 2. curator add github.com/<owner>/<repo> --pool ~/.agents/skill-repos |
| 305 | 3. curator find fullstack-dev # then it will hit |
| 306 |
low line 344
Access to home directory dotfiles
SourceSKILL.md
| 342 | ### Add a skill to the cold pool |
| 343 | ```bash |
| 344 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 345 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 346 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
low line 345
Access to home directory dotfiles
SourceSKILL.md
| 343 | ```bash |
| 344 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 345 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 346 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 347 | --output /tmp/my-index/ |
low line 346
Access to home directory dotfiles
SourceSKILL.md
| 344 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos |
| 345 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos --dry-run |
| 346 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 347 | --output /tmp/my-index/ |
| 348 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
low line 348
Access to home directory dotfiles
SourceSKILL.md
| 346 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 347 | --output /tmp/my-index/ |
| 348 | bunx @lythos/[email protected] add github.com/owner/repo --pool ~/.agents/skill-repos \ |
| 349 | --reason "Found via WebSearch for code review skills" --branch main |
| 350 | ``` |
critical line 165
Curl pipe to interpreter
SourceSKILL.md
| 163 | > `gh` CLI is required for precise skill discovery. Install it: |
| 164 | > - macOS: `brew install gh` |
| 165 | > - Linux: `curl -fsSL https://cli.github.com/install.sh | bash` |
| 166 | > - Then: `gh auth login` |
| 167 | > Or if you have a token: `echo "ghp_xxx" > .github-token && export GH_TOKEN=$(cat .github-token)` |
Scanned on Sep 11, 2026
View Security Dashboard