The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell scripts (get-org-metrics.sh, get-enterprise-metrics.sh, get-org-user-metrics.sh, and get-enterprise-user-metrics.sh) that utilize the gh api command to interact with GitHub's backend.
[DATA_EXPOSURE]: The skill retrieves usage metrics, including active user counts, acceptance rates, and per-user breakdowns. This data is sensitive but its retrieval is the explicitly stated purpose of the skill and relies on the user's existing GitHub permissions.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection via external API data ingestion.
Ingestion points: User-provided organization names and enterprise slugs; JSON response bodies from the GitHub API (retrieved in all .sh scripts).
Boundary markers: Absent; the skill does not use specific delimiters when processing the API results.
Capability inventory: Subprocess execution of the gh CLI for network API calls (found in all .sh scripts).
Sanitization: Absent; inputs are interpolated into shell strings, and API outputs are formatted for display without specific sanitization beyond the agent's default handling.

copilot-usage-metrics