The Agent Skills Directory

[COMMAND_EXECUTION]: The GitClient class in src/clients/git.py executes git commands using subprocess.run. The implementation follows security best practices by disabling shell execution, enforcing a timeout, filtering environment variables to prevent injection (like LD_PRELOAD), and using -c overrides to neutralize malicious local repository configurations such as core.fsmonitor and core.hooksPath.- [CREDENTIALS_UNSAFE]: The skill manages Google Cloud Platform (GCP) credentials via the GOOGLE_APPLICATION_CREDENTIALS environment variable to query GH Archive data via BigQuery. It includes a size limit on inline JSON credentials in src/clients/gharchive.py to prevent memory exhaustion (OOM) attacks from malicious environment variables.- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted data from the GitHub API, GH Archive, and local git history. Every findings in this category are assessed as LOW severity.
Ingestion points: Untrusted data enters the context through GitHubAPICollector, GHArchiveCollector, and LocalGitCollector (e.g., src/collectors/api.py).
Boundary markers: The skill uses Pydantic models for schema enforcement but lacks explicit prompt delimiters or instructions to the agent to ignore embedded commands in the forensic text it processes.
Capability inventory: The skill can perform network requests (requests.get), write files (EvidenceStore.save), and execute git commands (GitClient).
Sanitization: There is no explicit sanitization or escaping of external content before interpolation into prompts.- [DATA_EXFILTRATION]: The ConsistencyVerifier in src/verifiers/consistency.py performs network requests to URLs provided within evidence objects (verification.url). If an agent is induced to load a malicious evidence JSON file via EvidenceStore.load, this could be leveraged for Server-Side Request Forgery (SSRF) against internal resources. The developer has acknowledged this risk with specific security comments (nosemgrep).

github-evidence-kit