The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, making it a surface for indirect prompt injection attacks.
Ingestion points: The agent reads untrusted data through git diff, git log, gh pr view, and GitHub API responses (curl https://api.github.com/...) containing pull request descriptions and file contents in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters to isolate processed code or PR content from the agent's instruction context.
Capability inventory: The skill utilizes shell execution (git, gh, curl), file system access (read_file), and network access to GitHub services.
Sanitization: No sanitization or validation of the ingested code or PR metadata is performed before the agent processes it for review.
[DYNAMIC_EXECUTION]: The skill instructs the agent to execute automated test suites and linters directly from the repository being reviewed.
Evidence: Step 5 of the 'PR Review Workflow' and 'Repo Evaluation Workflow' suggests running commands like python -m pytest, npm test, cargo test, and go test in SKILL.md. If the repository or a pull request contains malicious test code, the agent will execute it locally.
[DATA_EXPOSURE]: The skill accesses a sensitive local file path to retrieve authentication credentials.
Evidence: The setup block in SKILL.md reads the GITHUB_TOKEN directly from ~/.hermes/.env. While storing secrets in environment files is standard practice, the automatic extraction of these credentials by the skill constitutes a sensitive data access pattern.

github-code-review