The Agent Skills Directory

[COMMAND_EXECUTION]: The Claude Code integration script in references/integrations.md is vulnerable to command injection. The script parses session JSON files using grep and sed to extract fields such as title and branch, which are then used directly inside shell echo commands. Since these variables are expanded within the shell environment without adequate escaping or sanitization, an attacker could include shell metacharacters (e.g., backticks or subshell syntax) in a GitHub issue title to execute arbitrary commands on the user's system.
[PERSISTENCE]: The skill instructs the agent to install a persistent hook in .claude/settings.local.json. This script is designed to run automatically every time a user submits a prompt to the agent, ensuring that the potentially vulnerable logic is executed repeatedly across different sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from GitHub Projects, which acts as an untrusted external source. This creates a vulnerability surface where malicious instructions embedded in project metadata could influence the agent's behavior.
Ingestion points: Data fetched via gh project item-list and stored in .ghpm/cache.json and .ghpm/sessions/*.json (referenced in SKILL.md and references/cache.md).
Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from following instructions found within the project data.
Capability inventory: The skill uses the GitHub CLI for network and project operations, performs file system reads and writes, and executes shell scripts.
Sanitization: No sanitization or validation logic is provided to filter out potential prompt injection attempts within GitHub issue titles or descriptions.

ghpm-shared