The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a Zsh script mirror-repo.zsh to automate repository management via the GitHub CLI (gh). It performs administrative tasks such as creating repositories, patching general settings, configuring security flags (secret scanning, AI detection), and setting up branch protection rules. These operations are transparently documented and match the stated purpose of the skill.- [EXTERNAL_DOWNLOADS]: Supports mirroring documentation content from external sources. Specifically, the --from-repo flag allows the script to clone a user-specified repository via git clone to extract and port GitHub Pages content into the new repository.- [CREDENTIALS_UNSAFE]: The skill manages DNS records by interacting with the Cloudflare API. It correctly references the CLOUDFLARE_API_TOKEN environment variable for authentication, which is a secure and standard way to handle API secrets without hardcoding them.- [INDIRECT_PROMPT_INJECTION]: The skill ingests repository metadata and settings from existing GitHub repositories and interpolates these values into generated files (README.md, site.js) using sed. While this constitutes an attack surface for untrusted metadata, the resulting data is used for static site generation rather than executable logic.
Ingestion points: Data retrieved from gh api responses and user-supplied flags like --description and --hero-eyebrow.
Boundary markers: Not present during the sed-based interpolation process.
Capability inventory: Broad repository write permissions via the gh CLI and git push capabilities.
Sanitization: Basic string interpolation is performed, but no formal sanitization or validation of the ingested repository metadata is implemented.

gh-repo-mirror