The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to update the git remote URL to include the authentication token if authentication issues occur.
Evidence: The instruction git remote set-url origin https://oauth2:${GITLAB_TOKEN}@gitlab.com/username/repo.git is present in both SKILL.md and README.md.
Details: Executing this command persists the GITLAB_TOKEN in plain text within the .git/config file of the repository. This exposes the credential to any entity with read access to the filesystem where the repository is stored.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external GitLab resources which could contain malicious instructions.
Ingestion points: Data is pulled from GitLab repositories, merge requests, and API responses as specified in the skill's description.
Boundary markers: No specific delimiters or warnings to ignore embedded instructions were found in the skill files.
Capability inventory: The skill uses git for repository operations, curl for API interactions, and a custom create_mr tool.
Sanitization: There is no evidence of sanitization or validation logic to filter potentially malicious content from merge request descriptions or repository files before the agent processes them.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands involving sensitive environment variables.
Evidence: Usage of curl with GITLAB_TOKEN and various git commands (checkout, add, commit, push) are explicitly detailed in SKILL.md and README.md.

gitlab