The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The go.mod and go.sum files reference several non-existent and poisoned versions of well-known Go libraries. These include github.com/spf13/cobra v1.10.2 (official latest: v1.8.1), github.com/spf13/pflag v1.0.9 (official latest: v1.0.5), github.com/cpuguy83/go-md2man/v2 v2.0.6, and go.yaml.in/yaml/v3 v3.0.4. The use of the go.yaml.in domain instead of the legitimate gopkg.in service indicates a typosquatting and dependency poisoning attempt.\n- [REMOTE_CODE_EXECUTION]: The skill instructs the user/agent to execute go run . during the setup process. This command triggers the Go toolchain to resolve, download, and execute the poisoned dependencies listed in the module configuration. This is a critical supply chain attack vector used to achieve arbitrary code execution on the user's system during the build phase.\n- [COMMAND_EXECUTION]: The documentation requires the agent to define a bash alias that executes the local Go module, which grants the agent the ability to execute arbitrary code and interact with system tools like gh and git.\n- [PROMPT_INJECTION]: The skill processes and displays output from GitHub Actions logs and artifacts. Because these sources are external and potentially influenced by untrusted contributors (e.g., via Pull Requests), they provide a surface for indirect prompt injection where malicious instructions could be embedded in the log output.\n
Ingestion points: The logs and artifacts subcommands in main.go read and display log data from the repository's local filesystem.\n
Boundary markers: The output uses basic text delimiters (e.g., ── Last 200 lines ──) but lacks explicit security instructions for the agent to treat the subsequent data as untrusted content.\n
Capability inventory: The associated Go tool can execute shell commands and perform filesystem writes within the repository workspace.\n
Sanitization: No sanitization or escaping is performed on the ingested log data before it is printed to the agent's context.

ci-feedback-loop