The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Forgejo servers which could contain malicious instructions designed to influence the agent.\n
Ingestion points: Commands such as issue list, pr show, and content get fetch untrusted text content (e.g., issue titles, PR descriptions, file contents) from the remote server into the agent's context.\n
Boundary markers: The tool uses JSON formatting to structure outputs, but it does not sanitize fetched text content to prevent the agent from accidentally executing instructions embedded within it.\n
Capability inventory: The tool possesses the capability to modify repository state, manage webhooks, and update file contents via the Forgejo API using provided tokens.\n
Sanitization: Input parameters are URL-encoded, and file contents are handled as base64 to ensure integrity, but semantic content is not filtered.\n- [DYNAMIC_EXECUTION]: The skill's test suite utilizes dynamic script loading to facilitate execution during automated testing.\n
Evidence: tests/test_cli.py uses importlib.machinery.SourceFileLoader to load the scripts/forgejo-cli script.\n- [DATA_EXFILTRATION]: The tool implements an undocumented mechanism to read authentication tokens from a specific hidden file path in the user's home directory, which are then transmitted over the network.\n
Evidence: The env function in scripts/forgejo-cli attempts to read credentials from ~/.hermes/.env as a fallback if environment variables are not present. While these credentials are sent to the user-specified server for authentication, the access to this specific hidden path is not mentioned in the user-facing documentation.

forgejo-cli