N Skills — agentic threat model

Not certain from the listing — The repository contains plugins rather than hosting its own foundation models. It relies on the host agent's LLM (e.g., Claude Code or Codex) and is subject to those models' vulnerabilities to prompt injection or adversarial reprogramming.

Not certain from the listing — The listing does not specify if these 5 skill plugins manage local vector stores or training data, but portable skills often require structured inputs/outputs which could be targets for data exfiltration if handled insecurely.

The plugins are designed to integrate directly into orchestration frameworks like Claude Code and Codex. The primary threat is insecure tool integration and tool misuse, where a malicious or poorly written skill plugin executes unauthorized system commands or API calls.

Not certain from the listing — As a set of portable plugins, deployment and sandboxing depend entirely on the host environment executing the agent (e.g., local developer machine vs. sandboxed container). There are no built-in infrastructure controls mentioned.

Not certain from the listing — There is no mention of built-in logging, guardrails, or evaluation mechanisms within the N Skills marketplace to monitor plugin behavior or detect anomalous execution.

The project is open-source and free, with no evidence of formal compliance certifications, access control policies, or code-signing mechanisms to verify the integrity of the 5 curated plugins.

This layer is highly relevant. The core value proposition is cross-agent skill portability. This introduces significant supply-chain risks where a single vulnerability or backdoor in a curated plugin can propagate horizontally across diverse agent ecosystems.