The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The workflow in fetching.md commands the agent to execute curl -L -H "Authorization: token $(gh auth token)" "<url>" using URLs extracted from markdown images or HTML elements in the issue text. Since these URLs are supplied by external users, this pattern exposes active session credentials to potentially malicious third parties.
[DATA_EXFILTRATION]: Transmitting sensitive authentication data to an arbitrary destination URL parsed from an untrusted source creates a direct mechanism for credential exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill lacks sufficient safeguards against untrusted inputs processed from GitHub repositories.
Ingestion points: Untrusted data enters the context during the ingestion of the issue body and comments via gh issue view as detailed in SKILL.md and fetching.md.
Boundary markers: Absent. No delimiters or isolation strategies are present to prevent the agent from obeying instructions or processing untrusted links embedded in comments.
Capability inventory: The agent has extensive shell command capabilities (gh, curl, file, ffprobe, ffmpeg) and file read/write permissions across the workspace.
Sanitization: Absent. There is no domain verification or whitelist logic to check if the extracted attachment URL belongs to a trusted GitHub domain before performing the curl operation with the auth token.

github-issue