The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to use a GitHub user_session cookie or GH_SESSION_TOKEN. The documentation warns that this cookie grants 'full account access' and is not scoped like a standard Personal Access Token (PAT). This encourages the handling of extremely sensitive credentials that facilitate total account takeover.
[REMOTE_CODE_EXECUTION]: The setup process requires running gh extension install drogers0/gh-image, which downloads and installs third-party code from a remote repository to be executed on the local machine.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution using the gh CLI. It pipes dynamic content into shell commands to modify pull requests and issues, which could be exploited if inputs are not strictly validated.
[DATA_EXFILTRATION]: The skill is designed to upload local files to GitHub's internal endpoints using high-privilege session tokens. This creates a pathway for transferring local data to remote servers under the context of a fully authenticated user session.
[EXTERNAL_DOWNLOADS]: Prerequisites include downloading an extension from a third-party GitHub repository (drogers0/gh-image) not included in standard trusted vendor lists.
[PROMPT_INJECTION]: The skill lacks clear boundary markers when processing untrusted input like image paths and repository names, creating a surface for indirect prompt injection.
Ingestion points: Local image file paths and GitHub repository strings provided by the user.
Boundary markers: None identified in the instructional flow.
Capability inventory: File system access, shell command execution via gh CLI, and network communication with GitHub APIs.
Sanitization: Uses --body-file - to safely handle multi-line content for PR bodies, but remains vulnerable to malformed file paths or repository names injected into the initial gh image command line.

github-image-upload