The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/check_github_env.py and scripts/publish_github_issues.py utilize the subprocess module to interact with the gh CLI. These operations are used to verify user authentication and publish approved audit findings. The commands are constructed using list-based arguments without a shell, which prevents command injection. Additionally, the skill implements validation and dry-run procedures before any data is sent to GitHub.
[PROMPT_INJECTION]: As the skill is designed to audit untrusted repositories, it is inherently exposed to indirect prompt injection (Category 8). The skill mitigates this by following a strict 'Audit Protocol' that requires the agent to maintain a gap ledger, record validation actions, and obtain explicit user approval for each issue draft and publication step.
[DATA_EXFILTRATION]: The skill reads .env files for configuration, such as default labels and duplicate-skipping settings. This follows standard secret management practices and the configuration scripts are designed to avoid logging or printing sensitive environment values.

codebase-issue-auditor