The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Dependabot alerts (package names, summaries) and interpolates them directly into shell commands for creating GitHub issues and PR labels. An attacker who controls a package name or security advisory could theoretically inject instructions that influence the agent's behavior or misrepresent the security status to human reviewers.
Ingestion points: gh api calls fetching Dependabot alerts (processed in SKILL.md).
Boundary markers: No explicit delimiters or instructions are used to separate untrusted alert content from the command logic in issue/PR creation.
Capability inventory: The skill can create and edit GitHub issues, modify pull requests (labels/merging), and dismiss security alerts via the GitHub API.
Sanitization: While the final reporting payload is JSON-encoded via Python, intermediate Bash commands use direct variable interpolation (e.g., gh issue create --title "security: bump $pkg...").
[COMMAND_EXECUTION]: The skill extensively uses the gh (GitHub CLI) tool to perform repository management, alert triage, and state changes. It also uses standard Unix utilities like grep, awk, and cat to parse configuration and alert data.
[DATA_EXFILTRATION]: The skill collects triage results and alert summaries, then transmits this data to an external API endpoint defined by the $PYLOT_API variable. It uses the $GH_TOKEN for authorization during this transmission. As the author is the vendor, this appears to be intended telemetry to a control plane.
[DYNAMIC_EXECUTION]: The skill utilizes python3 -c to transform JSON alert data and to assemble the final reporting payload. This is a standard method for data processing within shell-based skills but involves runtime execution of generated script strings.

security-runner