The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts using shell commands (e.g., python scripts/fetch/fetch_open_issues.py ${repo}) with arguments extracted directly from user prompts.
[COMMAND_EXECUTION]: Instructions guide the user to modify shell profile files (~/.bashrc and ~/.zshrc) via the echo command to persist the GITCODE_TOKEN environment variable across sessions.
[DATA_EXFILTRATION]: The script collection (fetch_open_issues.py, fetch_closed_issues.py, and fetch_issue_comments.py) accesses the Windows Registry (HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER) to retrieve the GITCODE_TOKEN if it is not found in the environment variables.
[PROMPT_INJECTION]: The skill processes untrusted external data by fetching issue titles, descriptions, and comments from the GitCode API, creating an indirect prompt injection risk.
Ingestion points: External content is pulled from api.gitcode.com through the fetch_*.py scripts.
Boundary markers: The classify_issue_comments.py script applies basic markdown escaping to titles, but the system lacks robust delimiters or explicit instructions to ignore embedded commands in the issue content.
Capability inventory: The skill environment allows for shell command execution and local file system writes (Excel and Markdown generation).
Sanitization: There is no comprehensive sanitization or validation of the fetched issue content before it is processed and presented to the agent.

gitcode-issue-analyzer