The Agent Skills Directory

[COMMAND_EXECUTION]: The manage-local-github.py script executes git and gh (GitHub CLI) commands via subprocess.run. Although it uses argument lists which prevents basic shell injection, it does not verify if user-provided repository identifiers start with dashes, potentially allowing argument injection into the underlying command-line tools.- [DYNAMIC_EXECUTION]: The tool dynamically generates local directory paths based on repository names. It fails to sanitize for directory traversal characters such as ... This allows a malicious instruction to potentially force the script to clone repositories or move directories into sensitive areas of the file system outside of the intended ~/github root.- [INDIRECT_PROMPT_INJECTION]: By design, this skill clones and reads data from arbitrary GitHub repositories. This creates a surface for indirect prompt injection, where content within a cloned repository could contain instructions that influence the agent's behavior during analysis.
Ingestion points: The scripts/manage-local-github.py script downloads external repository content into the local file system at a configurable path.
Boundary markers: There are no explicit delimiters or safety instructions provided to the agent to distinguish between the skill's management commands and the data contained within the cloned repositories.
Capability inventory: The skill can execute version control commands (git, gh) and perform file system operations including directory creation, renaming, and writes.
Sanitization: Repository specifications are parsed using simple delimiters (/ or @) without filtering for traversal sequences or command flags.

local-github