The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Several scripts (e.g., auto-close-duplicates.ts, backfill-duplicate-comments.ts, lifecycle-comment.ts, sweep.ts) require and access the GITHUB_TOKEN environment variable to authenticate with the GitHub API. This is the expected and necessary mechanism for the skill's stated purpose of GitHub automation.
[COMMAND_EXECUTION]: The script gh.sh serves as a security-hardened wrapper for the GitHub CLI (gh). It explicitly restricts execution to a predefined set of subcommands (issue view, issue list, search issues, label list) and validates flags to prevent the AI agent from performing unauthorized actions or accessing other repositories via search qualifiers like repo: or org:.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests untrusted data from GitHub issue titles, bodies, and comments to make decisions (e.g., detecting duplicates or stale issues).
Ingestion points: GitHub API responses for issues and comments in scripts/auto-close-duplicates.ts and scripts/sweep.ts.
Boundary markers: None; the scripts process API data directly.
Capability inventory: Network operations via fetch to the GitHub API (POST/PATCH for comments, labels, and issue states).
Sanitization: The scripts use regex to extract issue numbers and validate label names against a repository-defined list before applying them, which mitigates simple injection attempts.

github-management