The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to run npx -y gh-axi for all GitHub-related tasks. The -y (or --yes) flag explicitly instructs the package runner to skip the installation confirmation prompt, resulting in the silent download and execution of arbitrary code from the npm registry.
[EXTERNAL_DOWNLOADS]: The skill relies on an unverified external package (gh-axi) for its primary functionality. Since this package is not from a recognized trusted vendor or built-in toolset, its execution introduces a dependency on unvetted remote code.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface for indirect injection by ingesting untrusted external data and possessing high-privilege capabilities.
Ingestion points: The skill is designed to process GitHub issues, pull request content, gists, and search results, which are all attacker-controllable sources (SKILL.md).
Boundary markers: No delimiters or instructions are provided to the agent to treat external GitHub content as untrusted or to ignore embedded instructions.
Capability inventory: The skill has the ability to execute shell commands via npx and access sensitive GitHub API endpoints, including Actions secrets and repository variables.
Sanitization: There is no evidence of sanitization, validation, or escaping of the data retrieved from GitHub before it is processed by the wrapper or the agent.
[COMMAND_EXECUTION]: The skill encourages the agent to bypass standard tools (like the official gh CLI) in favor of a shell-based wrapper that executes dynamic commands.

gh-axi