The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external GitHub Gists and interpolates it into a prompt for a secondary LLM call.
Ingestion points: The fetchSessionHtml function in fetch-session.mjs retrieves the content of session.html from a GitHub Gist ID provided by the user via a URL.
Boundary markers: The script uses simple text headers like === Conversation === and [Turn X] HUMAN: to separate the instructions from the session data, which can be easily bypassed by adversarial content within the session transcript.
Capability inventory: The skill uses spawnSync to execute the pi CLI tool. While it uses the --no-tools flag for the summarization call, the output is returned to the main agent context.
Sanitization: No escaping, filtering, or validation is performed on the decoded session data before it is interpolated into the prompt variable in the generateHumanSummary function.
[EXTERNAL_DOWNLOADS]: The script fetches data from api.github.com/gists/ to retrieve session exports. This is a well-known service used for the skill's core functionality.
[COMMAND_EXECUTION]: The script executes the pi command-line tool using child_process.spawnSync to perform LLM-based summarization of the session data. The command is static and parameters like the provider and model are hardcoded, reducing the risk of arbitrary command injection through the CLI arguments themselves.

pi-share