The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check_pr.py is vulnerable to command injection in the check_branch function. It takes the branch_name argument directly from command-line input and interpolates it into a shell command string executed via subprocess.run(shell=True). This allows an attacker to execute arbitrary commands by providing a crafted branch name containing shell metacharacters like semicolons or pipes.\n- [DYNAMIC_EXECUTION]: The check_title function in scripts/check_pr.py uses the eval() function to compile a regular expression. The use of eval() for code execution is a dangerous practice that can be exploited if the pattern string is ever influenced by external data.\n- [CREDENTIALS_UNSAFE]: The documentation file SKILL.md contains a hardcoded GitHub Personal Access Token (ghp_test0000000000000000000000000000000000) in its usage examples. While this token appears to be a dummy value for testing, hardcoding credential patterns in documentation encourages unsafe security practices.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it processes external inputs (PR titles and branch names) through functions with execution capabilities.\n
Ingestion points: Data enters via command-line arguments in scripts/check_pr.py.\n
Boundary markers: None are present to distinguish data from instructions.\n
Capability inventory: The skill uses subprocess.run (shell execution) and eval (dynamic code execution).\n
Sanitization: No sanitization or validation is applied to inputs before execution.

pr-naming