The Agent Skills Directory

[COMMAND_EXECUTION]: User-provided inputs, such as the git user name, email, and agent name, are interpolated directly into shell commands (e.g., git config --global user.name "<name>" and printf 'GITHUB_APP_ID=%s\n' "$GITHUB_APP_ID"). This creates a vulnerability to command injection if the user provides input containing shell metacharacters like backticks, semicolons, or command substitutions.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8):
Ingestion points: The skill collects multiple strings from the user, including commit names, email addresses, and GitHub App metadata (name, homepage URL).
Boundary markers: Absent; while inputs are wrapped in double quotes in the provided bash snippets, there are no explicit boundary markers or instructions to the agent to sanitize or ignore embedded instructions within these inputs.
Capability inventory: The skill utilizes git config, printf, gh api, and curl, providing a pathway to manipulate configuration files and interact with external APIs.
Sanitization: No sanitization, escaping, or validation is performed on the user-provided strings before they are incorporated into executable commands.
[COMMAND_EXECUTION]: The skill uses node -e to execute a dynamic script string for generating JSON Web Tokens (JWT). This script reads a private key from the local filesystem (~/.cyrus/github-app.pem) and uses it to sign authentication payloads.
[COMMAND_EXECUTION]: A local web server is initiated using python3 -m http.server 8976 to serve an HTML file generated in the /tmp directory. This temporary server could potentially expose other files located in the same directory.

cyrus-setup-github