The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill attempts to automatically harvest GitHub authentication tokens from the local file system. It specifically targets the ~/.git-credentials file to extract plaintext credentials if the GITHUB_TOKEN environment variable is not set.\n
Evidence: In SKILL.md, the command GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials 2>/dev/null | head -1 | sed 's|https://[^:]*:$[^@]*$@.*|\1|') is used to scrape tokens.\n- [DATA_EXFILTRATION]: Credentials harvested from local files are automatically transmitted in the headers of curl requests to the GitHub API. While GitHub is a well-known service, the automated collection and transmission of local secrets is a high-risk pattern.\n
Evidence: The $GITHUB_TOKEN variable is used in multiple API calls to https://api.github.com across SKILL.md and references/ci-troubleshooting.md.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it downloads, extracts, and reads external CI log files without any sanitization or boundary markers.\n
Ingestion points: The skill downloads logs to /tmp/ci-logs.zip, extracts them, and reads the content of all .txt files in SKILL.md and references/ci-troubleshooting.md.\n
Boundary markers: None. No delimiters or instructions are used to prevent the agent from following malicious commands potentially embedded in the log content.\n
Capability inventory: The agent has the ability to execute git commands (commit, push, delete), make authenticated API calls (merge, create PRs), and modify local files.\n
Sanitization: No sanitization or validation is performed on the ingested log data before it is read into the context.\n- [COMMAND_EXECUTION]: The skill executes shell commands to manage the git lifecycle and process JSON data. It uses unzip to handle downloaded archives and python3 -c for parsing. The use of unzip -o on remote content in a shared directory without integrity verification is a noted security concern.

github-pr-workflow