The Agent Skills Directory

[COMMAND_EXECUTION]: The @ai-helper mention bot implementation in mention-bot.yml is vulnerable to command injection. It interpolates ${{ github.event.comment.body }} directly into a shell command using echo and sed. A malicious user could craft a comment containing shell metacharacters (e.g., backticks or $()) to execute arbitrary commands within the GitHub Actions runner environment.
[COMMAND_EXECUTION]: The smartCherryPick code snippet in the Git Operations section uses an exec function to run shell commands with interpolated variables like commitHash and targetBranch. If these parameters are derived from untrusted sources, such as PR comments or labels, it allows for arbitrary command execution.
[PROMPT_INJECTION]: The AI PR Review workflow (ai-review.yml) concatenates the entire pull request diff directly into the AI prompt. This creates an attack surface for indirect prompt injection, where a contributor can embed malicious instructions within their code or comments to manipulate the AI's feedback, potentially causing it to ignore bugs or approve unsafe changes.
[PROMPT_INJECTION]: The Issue Triage and Deployment Validation workflows interpolate untrusted text—issue titles, bodies, and commit messages—directly into prompts for classification and risk assessment. Attackers could use crafted text to influence these automated processes, such as mislabeling a high-priority bug or bypassing manual approval for a high-risk deployment.
[COMMAND_EXECUTION]: The repository configuration section includes a script for programmatically updating branch protection settings. This pattern requires high-privilege tokens and provides a mechanism to modify critical security controls, such as status check requirements and review enforcement, which increases the impact if the workflow is compromised.
[EXTERNAL_DOWNLOADS]: The skill references and provides links to official tools and resources, including the Gemini CLI and GitHub's official Actions documentation.

github-workflow-automation