The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data retrieved via the GitHub API, including user bios, profile READMEs, commit messages, and issue titles. This creates a risk of indirect prompt injection where an attacker could embed malicious instructions in their GitHub profile or repository to manipulate the agent's behavior during the analysis phase.
Evidence: The skill reads repository READMEs using gh api repos/{username}/{username}/readme and commit messages using gh api .../commits.
Ingestion points: Profile metadata, README content, commit messages, issue/PR titles (SKILL.md).
Boundary markers: None identified; content is interpolated directly into the context for analysis.
Capability inventory: The skill uses gh api to read data but does not appear to have write capabilities or arbitrary shell access beyond the predefined commands.
Sanitization: No explicit instructions for sanitizing or escaping the content retrieved from GitHub are present.
[COMMAND_EXECUTION]: The skill constructs shell commands using variables like {username} and {repo}. If the execution environment does not properly sanitize these inputs, it could lead to command injection if a malicious user provides a crafted username or repository name.
Evidence: Multiple commands in SKILL.md such as gh api users/{username} and gh api repos/{username}/{repo}/commits.

analyze-github-profile