The Agent Skills Directory

[COMMAND_EXECUTION]: The module modules/discussion-promotion.md defines workflows that execute shell commands using the GitHub CLI (gh api graphql). These commands use shell variables like $ENTRY_TITLE and $BODY which are derived directly from external, untrusted content ingested by the skill. This pattern is vulnerable to argument injection or shell command injection if the ingested content contains malicious shell metacharacters or specific command flags.
[DATA_EXFILTRATION]: In SKILL.md, the fetch protocol explicitly constructs file:// URIs from absolute paths provided as input. When combined with the skill's ability to promote content to public GitHub Discussions (Step 7), this creates a severe data exfiltration vector. An indirect prompt injection or a malicious user could provide paths to sensitive files (e.g., ~/.ssh/id_rsa, .env, or AWS credentials), which the agent may then read, summarize, and publish to an external repository.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted external resources (web articles, PDFs, blog posts), presenting a significant attack surface for indirect prompt injection.
Ingestion points: Content enters the context via WebFetch, Read operations, and document conversion tools.
Boundary markers: The skill mentions a mitigation strategy to wrap content in boundary markers per leyline:content-sanitization in Step 1.
Capability inventory: The skill possesses capabilities for network operations (gh api, WebFetch), shell command execution, and file system writes.
Sanitization: Includes a 'Scribe' validation step (scribe:slop-detector) to scan for common AI patterns and a document verifier to validate links.
[EXTERNAL_DOWNLOADS]: The skill performs frequent network requests to retrieve external content using WebFetch and document conversion services. While these are necessary for its primary purpose, they involve interaction with arbitrary, non-whitelisted domains.

knowledge-intake