The Agent Skills Directory

[COMMAND_EXECUTION]: The script bin/hunter.py uses the gh command-line tool to interact with GitHub. It correctly uses list-based arguments for subprocess.run, avoiding the risks associated with shell interpolation.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to GitHub's public API through the gh tool. This connectivity is necessary for the skill's functionality and is restricted to a well-known, trusted service.
[PROMPT_INJECTION]: The skill processes untrusted metadata and issue content from external GitHub repositories. While this creates a surface for indirect prompt injection, the script handles the data as structured JSON and does not execute the data content. Ingestion points: Repository information and issue lists fetched via gh api and gh issue list in bin/hunter.py. Boundary markers: The skill treats input as data to be parsed (JSON) and printed, not instructions to be followed. Capability inventory: The script is limited to read-only GitHub CLI operations and console output. Sanitization: External data is parsed using json.loads and passed safely to the user via standard output.

oss-hunter