The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Python subprocess module to execute git and gh (GitHub CLI) commands. This is used to extract commit logs, diffs, and pull request metadata from the local repository and GitHub.
[EXTERNAL_DOWNLOADS]: The starrocks_upgrade.py script fetches data from GitHub via the gh CLI. Specifically, it retrieves pull request and issue details from the StarRocks/starrocks repository. GitHub is a well-known and trusted service for this context.
[DATA_EXPOSURE]: The skill instructions prompt users to provide content from production configuration files (fe.conf and be.conf). While these files may contain environment-specific settings, the analysis is performed locally, and the data is used solely for identifying configuration conflicts in the new version. No evidence of remote exfiltration was found.
[INDIRECT_PROMPT_INJECTION]: The tool has an indirect prompt injection surface as it ingests untrusted data from GitHub pull request bodies and local git history. This content is then passed to sub-agents for analysis. The risk is mitigated by the use of structured output requirements and specific focus on code diff analysis.

starrocks-upgrade