The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates several shell commands, including Git operations and the execution of a local PowerShell script.
Evidence: The skill performs git fetch, git commit, and git push operations and invokes a repository-local script named Sync-CopilotSkillsToPrivateRepo.ps1 during its intake workflow.
[DATA_EXFILTRATION]: The skill is configured to automatically push changes to a remote repository, which could be misdirected if the environment is misconfigured.
Evidence: In safe-auto mode, the skill performs an automated git push. The target repository is resolved using the SYNC_PUBLIC_SKILLS_PRIVATE_REPO environment variable or user-provided paths. While the instructions include verification steps, an attacker capable of manipulating environment variables could potentially divert repository updates to an external destination.
[PROMPT_INJECTION]: The skill processes untrusted input sources (logs, history, diffs) to generate agent instructions, creating a surface for indirect prompt injection where malicious instructions in logs could be persisted into the skill repository.
Ingestion points: The skill accepts error log, Git diff, conversation summary, and terminal history as inputs in SKILL.md to update instructions.
Boundary markers: There are no explicit boundary markers or delimiters mentioned to isolate these untrusted data sources from the instruction-generation prompt.
Capability inventory: The skill has write access to the .github/skills/ directory, can perform git push operations, and can execute scripts found within the target repository.
Sanitization: No programmatic sanitization or escaping of the input data is performed; the skill relies on high-level instructions to 'abstract' the data before writing.

retro-private-skills