The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions include patterns to download and execute shell scripts directly from external URLs (https://claude.ai/install.sh and https://opencode.ai/install) by piping them to bash. While these represent official installation methods for the documented tools, executing remote content in this manner is a high-risk pattern.
[EXTERNAL_DOWNLOADS]: Fetches resources, binaries, and GitHub Actions from several external sources, including claude.ai, opencode.ai, and vendor-managed GitHub repositories like anthropics/claude-code-action and anomalyco/opencode.
[COMMAND_EXECUTION]: Includes commands for system-wide package installation (npm install --global opencode-ai) and execution of AI CLI tools (claude -p, opencode run) with elevated danger flags like --dangerously-skip-permissions for headless operation.
[PROMPT_INJECTION]: The skill sets up a surface for indirect prompt injection by configuring bots that respond to user-generated comments.
Ingestion points: GitHub and GitLab CI environments triggered by issue_comment and pull_request_review_comment events.
Boundary markers: The provided workflow templates do not include specific delimiters or instructions to the LLM to ignore potentially malicious content within the comments.
Capability inventory: The agents are granted write permissions to repository contents, pull requests, and issues, and are authenticated via secrets.
Sanitization: There is no explicit sanitization or filtering of comment bodies before they are processed by the agents.
[DATA_EXFILTRATION]: The skill explicitly warns that the share: true default in OpenCode workflows can cause session transcripts to be published to a public gateway, potentially exposing sensitive code or prompts if users do not manually disable this setting.

ci-agents