The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill searches for GitHub tokens in common local configuration files including ~/.hermes/.env and ~/.git-credentials to perform authenticated API calls.
[DATA_EXFILTRATION]: The skill uses curl to send data, including authentication headers, to GitHub's official API (api.github.com). This is normal functionality for a GitHub management tool but involves transmitting sensitive tokens to an external service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and displays external content from GitHub issues (titles, bodies, and comments). This creates a surface where an attacker could place malicious instructions in a GitHub issue that the agent then processes or displays.
Ingestion points: Reads issue data from https://api.github.com/repos/$OWNER/$REPO/issues and its sub-resources (SKILL.md).
Boundary markers: None identified; external content is printed directly to the console or interpolated into the agent context.
Capability inventory: The skill has the ability to write to the file system (git checkout), perform network requests (curl), and manage repository state.
Sanitization: Content is processed through python3 -c for display formatting but no specific filtering of prompt-like instructions is performed.

github-issues