The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides documentation for the GitHub CLI (gh), enabling the agent to perform extensive repository management, issue tracking, and CI/CD operations via command-line execution.
[CREDENTIALS_UNSAFE]: The reference includes commands such as gh auth token and gh auth status --show-token, which output sensitive authentication credentials directly to the console. If an agent executes these and displays the output, it could expose tokens in logs or conversation history. It also mentions sensitive file paths like ~/.ssh/id_ed25519.pub and .env in its examples.
[REMOTE_CODE_EXECUTION]: The skill documents the gh extension install command, which allows the agent to install and execute third-party extensions from arbitrary GitHub repositories. This capability could be exploited to download and run untrusted code in the agent's environment.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection through commands that read data from external, potentially attacker-controlled sources such as issue descriptions, pull request comments, and workflow logs.
Ingestion points: Untrusted content enters the agent context via gh issue view, gh pr view, and gh run view --log (SKILL.md).
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between its system instructions and the content retrieved from GitHub.
Capability inventory: The agent has access to repository management, secret setting, and file system operations via the GitHub CLI.
Sanitization: No sanitization or validation of the retrieved content is mentioned.

github-cli