The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains logic to automatically search for and extract authentication tokens from sensitive local files including ~/.git-credentials and ~/.hermes/.env without explicit user instruction to access these files.
Evidence: SKILL.md uses grep and sed to parse ~/.git-credentials for tokens stored in URLs.
[DATA_EXFILTRATION]: Harvested authentication tokens are transmitted to external endpoints at api.github.com via HTTP headers in curl requests.
Evidence: SKILL.md implements token extraction followed by use in Authorization: token $GITHUB_TOKEN headers.
[COMMAND_EXECUTION]: The skill frequently uses python3 -c to execute embedded code for processing and formatting JSON data retrieved from API calls.
Evidence: Multiple shell pipelines in SKILL.md pipe API output directly into Python execution blocks.
[PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue titles and bodies. This data is processed and presented to the agent without sanitization or protective boundary markers, creating a surface for indirect prompt injection attacks.
Ingestion points: SKILL.md fetches remote issue data via GitHub's API.
Boundary markers: Absent; issue content is printed directly to the output.
Capability inventory: The skill has access to shell commands (gh, git, curl) and the ability to read local credential files.
Sanitization: Absent; the Python processing scripts do not escape or validate the contents of issue fields before outputting them.

github-issues