The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands such as curl, base64, and tr to interact with the GitHub Contents API. It instructs the agent to use source on a local configuration file at ~/.config/gingiris/secrets.env to authenticate requests with a GITHUB_PAT token.
[DATA_EXFILTRATION]: The skill specifies access to a sensitive file path ~/.config/gingiris/secrets.env to retrieve credentials. While the credentials are used to communicate with a whitelisted domain (GitHub), the instruction to read local secret files for network operations represents a data exposure surface.
[INDIRECT_PROMPT_INJECTION]: The publishing workflow ingests a draft.md file without explicit sanitization or boundary markers. This creates a surface where malicious instructions embedded in the draft could potentially influence agent behavior. * Ingestion points: draft.md (read via base64 redirection). * Boundary markers: Absent. * Capability inventory: Shell command execution, network requests to GitHub, and sensitive file read. * Sanitization: Absent.
[DYNAMIC_EXECUTION]: The skill references and executes local Python scripts like sync-i18n.py and citability-scorer.py. The latter is invoked via a variable-based path resolution ($SCORER), which involves dynamic execution logic based on the environment structure.

gr-blog-post