The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting and processing external GitHub event data which constitutes a standard surface for indirect prompt injection. Ingestion points: The skill references using ${{ github.event }} and ${{ github.event.head_commit.message }} to access untrusted external data within workflows in references/actions-steps-expressions.md. Boundary markers: Documentation lacks explicit boundary markers or instructions to the agent to disregard embedded commands in event data. Capability inventory: The skill provides instructions for powerful actions including shell command execution (run), GitHub API calls (gh api), and secret modification (gh secret set) across various reference files. Sanitization: No sanitization or validation of the event data is demonstrated in the provided examples.
[DATA_EXPOSURE_AND_EXFILTRATION]: Documentation in references/actions-jobs-services.md contains hardcoded connection strings used in examples. Evidence includes DATABASE_URL: postgres://postgres:test@postgres:5432/testdb and POSTGRES_PASSWORD: test. These are identified as benign educational examples for setting up local test services in a CI environment and do not represent a threat to the user environment.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill mentions the installation of GitHub CLI extensions (gh extension install) and well-known third-party GitHub Actions (e.g., mxschmitt/action-tmate, dorny/paths-filter) in references/gh-cli-advanced.md and SKILL.md. These are standard tools in the GitHub ecosystem and are documented for common development workflows.

github