The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash() function to execute shell commands, including cloning repositories, performing file system operations in the /tmp directory, and interacting with the GitHub CLI (gh). It incorporates variables like repository names and issue numbers directly into shell strings, which could be exploited if source names are manipulated.
[REMOTE_CODE_EXECUTION]: The skill's automation workflows clone repositories from a GitHub organization and immediately proceed to run npm install and npm test. This pattern enables the execution of arbitrary code contained within those external repositories, such as malicious preinstall or test scripts, without human review of the code being executed.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, including repository file contents (package.json, CLAUDE.md), issue descriptions, and GitHub search results.
Ingestion points: Data enters the context through gh api calls fetching repository content, Read() calls on workspace files, and gh search results.
Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent to ignore or isolate potentially malicious instructions embedded within the fetched repository data.
Capability inventory: The skill possesses broad capabilities including shell execution via Bash, package management via npm, and GitHub API write access for creating PRs and issues.
Sanitization: There is no evidence of sanitization, escaping, or schema validation for the content retrieved from external repositories before it is processed or used to generate subsequent commands.
[OBFUSCATION]: The skill frequently uses base64 encoding and decoding to interact with the GitHub API's content endpoint. While this is a standard requirement for that specific API, it involves the agent processing and executing logic based on encoded strings that are not immediately readable in their raw form.

github-multi-repo