The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads content from raw.githubusercontent.com and api.github.com to manage the upload branch and retrieve files. These operations target well-known services and are core to the skill's functionality.
[COMMAND_EXECUTION]: The scripts/upload.py script uses subprocess.check_output to execute git remote get-url origin. This identifies the working repository and is a standard practice for git-integrated utilities.
[CREDENTIALS_UNSAFE]: The skill reads GitHub authentication tokens from environment variables like GH_TOKEN. This method follows security best practices for secret management in development tools.
[PROMPT_INJECTION]: The skill ingests external data by downloading files from a user-controlled GitHub branch. This creates a surface for indirect prompt injection, which is a standard consideration for any tool designed to process external inputs.

uploading-files