The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection as it is designed to ingest and analyze untrusted content from GitHub commits and pull requests to provide recommendations, generate code, and automate repository actions.
Ingestion points: Processes data from the repository using gh pr view, ${{ github.sha }}, and ${{ github.event.workflow_run.id }}.
Boundary markers: None identified in the provided implementation templates; tool outputs are interpolated into shell commands.
Capability inventory: Possesses capabilities to write files (.github/workflows/ci.yml), execute shell commands, and interact with the GitHub API to create issues, pull requests, and comments.
Sanitization: Not explicitly implemented in the provided shell templates; uses raw interpolation of external data into shell command arguments.
[EXTERNAL_DOWNLOADS]: The skill relies on external components fetched from remote sources at runtime.
Findings: Uses npx to download and execute ruv-swarm and claude-flow@alpha (a vendor-associated package) CLI tools. It also references ruvnet/swarm-action@v1 as a GitHub Action dependency.
[DYNAMIC_EXECUTION]: The skill generates and interacts with executable content dynamically.
Findings: Includes templates that generate GitHub Actions workflow YAML files based on repository analysis and mentions "self-healing" capabilities that automatically apply fixes to the codebase.
[COMMAND_EXECUTION]: Executes shell commands through the GitHub CLI (gh) to perform repository management tasks.
Findings: Automates the creation of issues, pull requests, and comments by piping tool output into gh commands, which could be exploited if the tool output is manipulated via injection.

github-workflow-automation