The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill attempts to read a sensitive credential file from a hardcoded path.
Evidence: Phase 5 contains a script that executes TOKEN=$(cat ~/.config/forgejo/token) to authenticate remote API calls.
Risk: This exposes the user's Forgejo authentication token to the agent's context and any subsequent network operations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR comments and uses them to guide its automated fix loop, creating a vulnerability surface for instruction injection.
Ingestion points: Phase 1 retrieves bot and human comments using gh api repos/$REPO/pulls/$PR/comments.
Boundary markers: The skill instructions do not provide delimiters or warnings to the agent to treat this external content as data rather than instructions.
Capability inventory: The skill possesses extensive capabilities, including shell command execution (npm, pip, docker, terraform), file system writes, and the ability to push code to remote repositories (git push).
Sanitization: No sanitization, validation, or filtering of the external comment content is performed before it is used to influence code changes.
[COMMAND_EXECUTION]: The skill executes a wide range of system-level commands and package manager operations based on external PR state.
Evidence: Use of npm ci, pip install, docker build, terraform validate, and git push across various phases.
Risk: While functionally relevant to PR management, the combination of high-privilege commands with untrusted input (PR comments) increases the risk of malicious code injection or unauthorized system changes.

pr-fix