The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to update GitHub PR bodies using shell command substitution: gh pr edit --body "$(gh pr view --json body -q .body) ...". This pattern is vulnerable to indirect prompt injection and command execution if the PR body (untrusted external data) contains shell-sensitive characters like backticks or subshell syntax.
Ingestion points: The output of gh pr view --json body in SKILL.md.
Boundary markers: None present to delimit the untrusted data from the command.
Capability inventory: Shell execution (gh, curl, screencapture), file system access (/tmp), and network operations (img402.dev).
Sanitization: No escaping or validation is performed on the PR body before interpolation into the shell command.
[DATA_EXFILTRATION]: The skill captures local screen data using screencapture and uploads it to an external endpoint https://img402.dev/api/free. Although this aligns with the skill's stated purpose and uses the vendor's own infrastructure, users should be aware that visual data from the local environment is transmitted to a third-party service.

github-image-hosting