The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection as it processes untrusted content from external security advisories and interpolates it into the agent's context and output.
Ingestion points: Fetches alert metadata (summaries, package names, vulnerability ranges) from the GitHub Dependabot API in Step 1.
Boundary markers: None. The skill directly interpolates external strings into issue bodies, PR labels, and the final summary report.
Capability inventory: The skill utilizes Bash to invoke gh (GitHub CLI), curl, and python3 for repository management and data transmission.
Sanitization: No escaping or validation is performed on the data fetched from the API before it is used in subsequent steps.
[COMMAND_EXECUTION]: The script extracts data fields using python3 -c and assigns them to shell variables which are then used as arguments in commands like gh issue create and gh pr list. Maliciously crafted package names or advisory summaries containing shell metacharacters (e.g., backticks, subshells) could lead to command injection within the local execution environment.
[DATA_EXFILTRATION]: In Step 6, the skill transmits a summary report containing repository details and the user's GH_TOKEN to a remote endpoint defined by PYLOT_API. While this matches the vendor's automation patterns, it involves the outbound transmission of sensitive credentials and security posture data.

security-runner