The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data that is subsequently displayed in notifications and logs, creating a potential injection surface.
Ingestion points: The skill fetches pull request comments and titles via gh api (Arm A3), and reads advisory content from memory/pending-disclosures/ (Arm C2) and internal issue trackers (Arm C4).
Boundary markers: Not present. External content, such as maintainer comment excerpts, is interpolated directly into the markdown notification buffer without delimiters or safety warnings for the recipient agent.
Capability inventory: The skill operates with mode: write and utilizes gh api (with elevated PAT permissions), git mv, and rm for state management, along with a local ./notify script for output.
Sanitization: No sanitization, escaping, or filtering of the external strings is described before they are included in the generated notification message.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from GitHub's API using gh api and curl.
Evidence: Accesses api.github.com to retrieve PR status, star counts, and security advisory details.
Context: These operations target a well-known service and are consistent with the skill's primary purpose of vulnerability tracking. They do not involve executing remote code.
[COMMAND_EXECUTION]: The skill relies on several CLI tools to perform its logic.
Evidence: Uses gh, jq, mkdir, git mv, rm, and a local ./notify script to interact with GitHub and manage local memory files.
Context: These commands are used for standard data processing and file management tasks within the expected scope of a development and security tool.

vuln-tracker