The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs an automated installation of the sudosubin/gh-attach GitHub CLI extension. This involves downloading and installing code from a third-party repository that is not managed by a verified trusted organization or the skill author.\n- [REMOTE_CODE_EXECUTION]: By using gh extension install, the skill executes remote code from an external source at runtime. This introduces a supply chain risk as the extension's code is not verified for safety before execution.\n- [COMMAND_EXECUTION]: The skill uses multiple shell commands to manage extensions and perform file operations. These commands are vulnerable to manipulation if the input parameters (such as file paths) are not strictly controlled.\n- [DATA_EXFILTRATION]: The core functionality of the skill is to upload local files to GitHub's infrastructure. If the agent is directed to process sensitive files like .ssh keys, AWS credentials, or .env files, this mechanism can be used for unauthorized data exfiltration.\n- [CREDENTIALS_UNSAFE]: The documentation encourages the use of GH_ATTACH_SESSION_TOKEN to store a user_session cookie. This cookie grants full access to a GitHub account, and handling it as an environment variable or passing it through the agent context is an unsafe credential management practice.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests external file paths and URLs without boundary markers or sanitization. An attacker could provide a malicious file path to trigger sensitive data uploads. Ingestion points: $FILE and $URL parameters; Boundary markers: Absent; Capability inventory: gh extension install, gh attach, gh pr comment; Sanitization: None.

gh-attach