The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands using user-supplied input for the repository owner and name in Step 2: gh repo clone <owner>/<repo>. If the URL parsing in Step 1 is not strictly validated, this creates an injection surface where a malicious user could provide a repository path containing shell metacharacters (e.g., semicolons or backticks) to execute unauthorized commands or manipulate arguments within the allowed gh tool scope.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external repositories.
Ingestion points: Step 4 involves reading up to 20 files from the cloned repository, including .json, .js, .ts, and .css files.
Boundary markers: There are no boundary markers or instructions to the agent to ignore embedded natural language commands within the ingested file content.
Capability inventory: The skill has access to Bash, Read, and Write tools. If the agent follows instructions hidden in a repository's theme.json or tailwind.config.js, it could be coerced into performing unauthorized file operations or network calls.
Sanitization: The skill performs regex extraction for colors and fonts but processes the overall file content to identify these tokens without sanitizing the input for potential prompt injection patterns.
[EXTERNAL_DOWNLOADS]: The skill downloads content from GitHub repositories using the gh CLI. This operation targets a well-known service and is necessary for the skill's primary function of repository ingestion.

ingest-github