The Agent Skills Directory

[COMMAND_EXECUTION]: The collect.py script executes local shell commands using subprocess.run to interact with git and the GitHub CLI. This is used to retrieve commit history, file lists, and repository metadata. The commands are passed as lists to avoid shell injection.
[EXTERNAL_DOWNLOADS]: The skill uses the GitHub CLI to fetch data from the GitHub API when analyzing an organization's repositories. These requests target GitHub, a well-known service, to retrieve public or authorized repository metadata.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data, such as repository and folder names, which are then interpolated into an HTML report using innerHTML in render.py. This creates a potential Cross-Site Scripting (XSS) surface. Ingestion points: Repository and directory names from the local file system or GitHub API in collect.py. Boundary markers: Absent in the HTML renderer. Capability inventory: Subprocess calls to git and the gh CLI in collect.py. Sanitization: Absent in render.py for repository title rendering within the HTML report.

context-coverage