The Agent Skills Directory

[COMMAND_EXECUTION]: The skill translates run: blocks from repository workflow files directly into shell commands. This allows for the execution of arbitrary code as defined in the project's configuration files.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted instructions within GitHub Action YAML files.
Ingestion points: Phase 1 reads workflow files from the .github/workflows/ directory.
Boundary markers: The instructions lack explicit boundary markers or warnings to ignore instructions embedded in the workflow YAML.
Capability inventory: Uses the Bash and Task tools to execute commands on the host system.
Sanitization: No validation or sanitization of the extracted command strings is performed prior to execution.
[DATA_EXFILTRATION]: The skill is instructed to access and parse local .env files to check for keys matching secrets defined in the workflow. This represents automated access to sensitive local environment configurations.

ci-local