The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains instructions to access sensitive credential stores, including ~/.git-credentials for token extraction and ~/.ssh/id_rsa for uploading private keys as GitHub secrets. Harvesting plaintext credentials and encouraging the transfer of private keys significantly increases the risk of credential compromise.\n- [REMOTE_CODE_EXECUTION]: Automated analysis flagged a pattern where output from curl is piped to python3. While the scripts in the provided files use the -c flag to parse JSON data, the underlying architecture of piping remote data into a language interpreter is inherently dangerous and considered a high-risk practice.\n- [COMMAND_EXECUTION]: The skill utilizes a wide array of shell commands (git, gh, curl, python3, unzip) to perform its tasks. This provides the agent with extensive capabilities to manipulate the local filesystem and interact with remote services, expanding the potential impact of any exploit.\n- [DATA_EXFILTRATION]: The skill reads authentication tokens and private keys from the user's home directory. While these are used for authenticating with GitHub's official API, the programmatic access to these secrets creates a risk of exfiltration if the environment or the skill itself is compromised.\n- [EXTERNAL_DOWNLOADS]: Frequent interactions with api.github.com and repository cloning from github.com are performed. These are well-known services required for the skill's functionality.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting and processing untrusted content from the GitHub API (e.g., repository descriptions, search results, release notes, and workflow logs) without using delimiters or sanitization.\n
Ingestion points: API response fields containing repository metadata and content in SKILL.md sections 4, 8, and 9.\n
Boundary markers: None; there are no instructions to the agent to treat external content as untrusted or to ignore embedded commands.\n
Capability inventory: Shell command execution (git, gh, curl, unzip) and file manipulation.\n
Sanitization: None; the skill does not perform any validation or escaping of the data received from GitHub before it is processed.

github-repo-management