The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries such as gh, curl, rsvg-convert, and convert using the subprocess.run method. All commands are constructed using argument lists, which effectively prevents shell injection vulnerabilities. Evidence found in scripts/gh_repo_card.py and scripts/gh_trending_card.py.\n- [EXTERNAL_DOWNLOADS]: Repository metadata and image assets are retrieved from trusted domains, specifically api.github.com and github.com. Automated scanner alerts regarding remote code execution are determined to be false positives, as the downloaded content (JSON, HTML, and binary images) is parsed as data and never executed as code.\n- [CREDENTIALS_UNSAFE]: The skill manages API authentication by accessing GITHUB_TOKEN or GH_TOKEN from environment variables. This is a standard and recommended practice for integrating with the GitHub API, and no hardcoded secrets were detected.\n- [SAFE]: No malicious patterns, including prompt injection, obfuscation, privilege escalation, or persistence mechanisms, were found across the skill files.

github-repo-cards