The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements automated logic specifically designed to harvest sensitive credentials from the environment.
The get_github_auth() function in SKILL.md scans multiple environment variables (GITHUB_PAT, GH_PAT, GITHUB_TOKEN, GH_TOKEN) and explicitly opens sensitive file paths such as /mnt/project/.env and /mnt/project/github.env to extract secrets.
[DATA_EXFILTRATION]: The skill provides the necessary mechanisms to move data from the local environment to a remote server.
The push_file Python function and the curl -X PUT Bash examples allow the agent to upload arbitrary content to GitHub repositories. When combined with the automated credential detection, this creates a high-risk path for exfiltrating local source code or configuration data.
[COMMAND_EXECUTION]: The skill provides numerous pre-written shell commands for the agent to execute in the local environment.
SKILL.md contains multiple examples using curl and bash to interact with network services, download repository archives, and manipulate the local filesystem (e.g., extracting archives with tar -xzf).
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading code and data from external domains.
It utilizes api.github.com and raw.githubusercontent.com to fetch individual files and repository tarballs. Although these are well-known services, the skill enables the retrieval and potential execution of content from these remote sources.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection through the ingestion of external data.
Ingestion points: The fetch_file function and curl commands ingest data directly from remote GitHub repositories.
Boundary markers: None. Fetched content is processed as raw data or code without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses file-writing capabilities, network access, and shell execution permissions.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from external sources before it is processed by the agent.

accessing-github-repos