The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions explicitly direct the agent to retrieve the active GitHub authentication token using $(gh auth token) and include it in a shell command string. This pattern exposes sensitive credentials to the process environment and potential log outputs.
[DATA_EXFILTRATION]: The skill uses curl to download assets from URLs extracted from GitHub issue comments while passing the user's authentication token in the request header. Since issue comments are external, untrusted inputs, an attacker could provide a malicious URL to trick the agent into sending the secret token to an attacker-controlled server.
[COMMAND_EXECUTION]: The skill executes multiple shell operations including curl, git worktree, and gh api. These commands are constructed using parameters derived from external repositories, file paths, and environment variables, which increases the risk of command injection if source data is manipulated.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads and processes untrusted content from GitHub issue bodies and comments to generate release notes and marketing copy (SKILL.md).
Boundary markers: There are no instructions to use delimiters or specific ignore-tags to separate untrusted comment content from the agent's core logic.
Capability inventory: The skill possesses significant capabilities including file system modification (git worktree), network access (curl), and GitHub metadata modification (gh api).
Sanitization: No sanitization or validation steps are described; the skill is explicitly told to extract 'verbatim quotes' from the untrusted issue data.

release-comms