The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/config.json contains a hardcoded Gitee access_token (b8fc164c5c229adfdbf7e6a9bb59c76c). This grants anyone with access to the skill the ability to perform operations on the liskill-members repository under the author's account.
[COMMAND_EXECUTION]: The skill workflow requires the agent to execute shell commands including git add, git commit, git push, and python3. These operations are used to update the repository and run the publication script.
[DATA_EXFILTRATION]: The scripts/publish.py script reads the content of local SKILL.md files and transmits them to Gitee's API using urllib.request. While this is intended for publishing, it involves sending local data to an external remote service.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied directories and skill files, which introduces a vulnerability where malicious instructions embedded in a skill package could be processed by the agent.
Ingestion points: SKILL.md files located in the directory path provided by the user during the "Receive Skill Package" step.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill can execute shell commands (git), run Python scripts, and perform file system writes to README.md and skills/li/SKILL.md.
Sanitization: There is no evidence of sanitization or validation of the content of the SKILL.md file before it is read or uploaded.

li-skill-publisher