The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill in references/auth.md explicitly recommends configuring the git credential helper with git config --global credential.helper store, which saves GitHub Personal Access Tokens in plaintext in the ~/.git-credentials file.
[DATA_EXFILTRATION]: The script scripts/git-credential-token.py is specifically designed to read and parse the sensitive ~/.git-credentials file to extract raw authentication tokens. This behavior is repeated in scripts/gh-env.sh and across several reference files (references/issues.md, references/pr-workflow.md, references/repo-management.md) which export these tokens to the environment for use in shell commands.
[DATA_EXFILTRATION]: scripts/gh-env.sh also attempts to read and extract the GITHUB_TOKEN from ~/.hermes/.env, another sensitive configuration file.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external sources (GitHub issue and PR comments) via commands like gh issue view --comments and gh pr view --comments (documented in references/issue-to-pr.md).
Ingestion points: GitHub issue thread comments and pull request discussion threads.
Boundary markers: None; the agent is instructed to read the "live state" from these comments to guide its next actions.
Capability inventory: The skill has broad capabilities including file writing (write_file, patch), command execution (gh, git), and network operations (curl to GitHub API).
Sanitization: There is no evidence of sanitization or filtering applied to the ingested comment data before it is used to influence the agent's logic for code modifications or repository management.

github