The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill programmatically accesses the user's GitHub authentication token using the command $(gh auth token) for use in external network requests.
[DATA_EXFILTRATION]: In the image download process (Phase 1), the skill includes the GitHub authentication token in the request header (-H "Authorization: token ...") sent via curl to URLs extracted from GitHub issue comments. If an attacker provides a malicious URL in a comment that bypasses simple extraction logic, the token will be exfiltrated to the external server.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub issues (body and comments) and provides it to subagents for analysis and uses it to compose new GitHub issues in Phase 5.
Ingestion points: GitHub issue data retrieved via gh issue view in Phase 1.
Boundary markers: Requirement text is isolated in the subagent prompt in Phase 2.
Capability inventory: The skill has access to shell commands (gh, git, curl), can write files to the local system, and can perform network operations via gh and curl.
Sanitization: The skill lacks explicit sanitization or validation routines for the content extracted from issue comments before it is used in subagent prompts or written to the GitHub API via the split or update-in-place flows.
[COMMAND_EXECUTION]: The skill dynamically constructs shell commands using gh, git, and curl with parameters (such as URLs and issue numbers) derived from untrusted issue data, which could lead to command injection if not handled securely by the underlying platform.
[EXTERNAL_DOWNLOADS]: The skill utilizes curl to fetch external assets based on URLs found in issue bodies and comments, posing a risk if these downloads are not strictly restricted to trusted domains.

audit-ticket