The Agent Skills Directory

Command Execution: The skill utilizes local Python scripts and the GitHub CLI to perform tracking and validation tasks. These shell-based operations are managed through security practices such as explicit shell-quoting of arguments, identity pinning for authentication, and the use of temporary files for handling large data payloads to prevent command injection.
Indirect Prompt Injection Surface: The skill ingests data from security scans, which represents a potential attack surface if malicious instructions are embedded within the findings. This is mitigated by instructions requiring the agent to treat all input data as literal strings rather than instructions, alongside a mandatory user approval gate where the exact payload must be reviewed before any external transmission.
Authorized Data Integration: The skill interacts with external providers to manage security issues and advisories. To prevent unauthorized data disclosure, the skill enforces destination verification and visibility checks (e.g., checking for private repository status) and requires the user to explicitly confirm that the intended audience is approved to see the finding details.

track-findings