The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via the official gh CLI. In scripts/github.py, subprocess.run is used to invoke gh for read operations. The commands are constructed using a fixed list of arguments, minimizing the risk of arbitrary command injection. While the static analyzer flagged the use of subprocess.run, the implementation is controlled and limited to the expected CLI tool's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from GitHub (issue bodies, PR descriptions, workflow logs) which could potentially contain malicious instructions.
Ingestion points: External data enters through scripts/github.py when viewing issues, PRs, or workflow runs.
Boundary markers: The output is formatted as Markdown with clear headers and bullet points to distinguish metadata from content.
Capability inventory: Subprocess calls are limited to the gh CLI for read/view operations.
Sanitization: The script performs basic formatting but relies on the LLM's own safety guardrails when processing the Markdown output. The risk is categorized as low due to the lack of dangerous downstream write capabilities within the script itself.
[SAFE]: The skill references official GitHub documentation and the official gh CLI, which are trusted sources. It does not perform unauthorized network operations, exfiltrate data, or attempt to persist across sessions. Authentication is handled through the standard gh auth login process, and no secrets are hardcoded.

github