The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes logic to retrieve GitHub authentication tokens from local files such as ~/.hermes/.env and ~/.git-credentials. This is a standard procedure for tools requiring programmatic access to GitHub services.
[COMMAND_EXECUTION]: The skill facilitates numerous shell-based operations including cloning, creating, and forking repositories. It also includes instructions for managing repository secrets, such as uploading an SSH key using gh secret set SSH_KEY < ~/.ssh/id_rsa. While this involves accessing sensitive files, it is the intended primary purpose of the secret management functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the GitHub REST API, such as repository descriptions, list of topics, and workflow run names. This data is processed by the agent and could theoretically contain malicious instructions, though this is a general attack surface for all API-integrated tools.
[DATA_EXFILTRATION]: Although the skill reads local configuration and credential files, all network operations target api.github.com, which is a well-known and trusted service. There is no evidence of data being sent to unauthorized or suspicious third-party domains.
[REMOTE_CODE_EXECUTION]: Automated scanners identified patterns where curl output is piped to python3. A manual review of SKILL.md confirms these are false positives; the piping is used exclusively to pass JSON responses from the GitHub API to a local Python one-liner (-c) for safe parsing of specific fields, rather than executing downloaded code.

github-repo-management