The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The instructions in SKILL.md and README.md direct the agent to update the git remote URL using the GITHUB_TOKEN (e.g., git remote set-url origin https://${GITHUB_TOKEN}@github.com/...). This practice results in the sensitive token being stored in plain text within the .git/config file in the workspace, which can lead to accidental exposure through logs, backups, or unauthorized file access.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources including GitHub issue bodies and pull request review comments.
Ingestion points: GitHub issues and review comments are retrieved via scripts/github_client.py and processed according to instructions in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore or isolate embedded instructions within the retrieved GitHub content.
Capability inventory: The skill possesses significant capabilities including shell command execution (subprocess.run), git push operations, and pull request merging.
Sanitization: No sanitization or filtering is applied to the external content before it is incorporated into the agent's active context, allowing a malicious actor to potentially influence the agent's behavior via adversarial comments.
[COMMAND_EXECUTION]: The scripts/github_client.py file contains a shell method that utilizes subprocess.run to execute arbitrary commands. While it includes logic to redact tokens from the command output, the utility provides a mechanism for the agent to execute shell-level operations which, if combined with indirect prompt injection, increases the attack surface for unauthorized system interactions.

github