The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the gh CLI to perform API calls. Commands are constructed by interpolating user-provided repository names, usernames, and email addresses.
[INDIRECT_PROMPT_INJECTION]: The skill accepts external input (usernames/emails) that is processed and used to perform administrative tasks on GitHub repositories.
Ingestion points: GitHub identifiers (usernames and emails) provided by the user in Step 0 of the workflow (SKILL.md).
Boundary markers: The skill includes a resolution and verification phase where a table is presented to the user for explicit confirmation before any write actions occur.
Capability inventory: The skill has the capability to grant (PUT), revoke (DELETE), and list (GET) repository collaborators and organization memberships via gh api across all functional paths.
Sanitization: Input identifiers are validated against GitHub's user and search APIs to ensure they correspond to valid accounts before being used in state-changing commands.
[SAFE]: The skill follows security best practices by defaulting to pull (read-only) permissions and preventing automatic escalation to administrative roles without explicit user interaction and confirmation.

lov-gh-access