The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/set_secrets.py executes the gh (GitHub) CLI using subprocess.run. These calls use list-based arguments and pass sensitive values via standard input (input=value), which is a secure practice that avoids exposing secrets in process lists or shell history.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection in scripts/install_ci.py. It reads repository names and versions from an external dependencies.json file and interpolates them directly into GitHub Actions workflow files (.github/workflows/build.yml) without sanitization. An attacker providing a malicious project configuration could potentially inject unauthorized steps into the generated CI workflows.
Ingestion points: Project/Sources/dependencies.json is read in load_github_deps (scripts/install_ci.py).
Boundary markers: None identified; strings are directly interpolated into YAML templates.
Capability inventory: write_file (scripts/install_ci.py) can write generated workflow files to the local file system.
Sanitization: No escaping or validation is performed on the github or version fields before interpolation.
[DATA_EXFILTRATION]: While the skill manages sensitive DLTK tokens, it employs security controls to prevent exposure. SKILL.md contains explicit instructions for the AI agent to never read the assets/config.yml file, and the scripts handle these tokens using secure piping to the GitHub CLI.

4d-github-ci