The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains shell command injection risks. In the monitor and releases views, repository identifiers are passed to gh CLI commands using unquoted shell variables (e.g., $repo). While the add-repo utility validates input with a strict regex, the releases and issues views parse the user-supplied var input into a SCOPE token that is interpolated into shell command strings without equivalent validation or quoting.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub, including PR titles and issue descriptions. It correctly identifies this attack surface and includes specific instructions to handle the data safely.
Ingestion points: GitHub API JSON data fetched via gh and WebFetch in SKILL.md.
Boundary markers: The instructions in SKILL.md specify that the agent should render content as plain strings and summarize bodies rather than executing them.
Capability inventory: The skill possesses network access, file write capabilities in the memory/ directory, and the ability to send notifications.
Sanitization: The skill includes explicit safety warnings in its "Security" section to ignore instructions embedded in external content.
[SAFE]: The skill's external network interactions are limited to official GitHub API endpoints, and its default watch list targets well-known and reputable technology organizations.

github-monitor