The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and executes third-party packages from the npm registry using the npx command, specifically ruv-swarm and claude-flow@alpha. These packages originate from the ruvnet organization, which is not verified as a trusted vendor in this context.
[REMOTE_CODE_EXECUTION]: The skill performs runtime execution of remote code through multiple npx calls to coordinate swarm tasks and manage project boards.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub issues and comments to trigger actions, creating a surface for indirect prompt injection. * Ingestion points: GitHub issue data fetched via gh issue view (body, comments, labels) and gh issue list. * Boundary markers: None present in the provided templates; instructions are interpolated directly from issue content. * Capability inventory: Shell command execution (gh), network communication via npx tools, and modification of GitHub project items. * Sanitization: Not explicitly implemented in the skill scripts.
[COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (gh) and jq to manipulate repository metadata and project boards.
[DATA_EXFILTRATION]: The configuration includes support for an external webhook endpoint (https://api.example.com/github-sync), which indicates the capability to transmit repository data to external servers.

github-project-management