The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's setup workflow in SKILL.md (Step 3) generates a shell command using string interpolation (e.g., \"$REPO\", \"$LOCAL_CHANGES\") to construct a JSON payload for a curl request. This pattern is vulnerable to command injection if the variables—sourced from user input or repository metadata—contain shell metacharacters such as backticks, semicolons, or single quotes.- [CREDENTIALS_UNSAFE]: The skill manages a high-privilege GITHUB_PERSONAL_ACCESS_TOKEN. It instructs the agent to verify this token by executing a curl command where the token is passed in the Authorization header. This practice can expose sensitive credentials in process logs or shell history depending on the agent's environment configuration.- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface. In SKILL.md, it takes unsanitized user inputs (REPO and LOCAL_CHANGES) and interpolates them directly into a natural language prompt that defines a long-running background automation. The absence of boundary markers or instructions to ignore embedded commands within these variables could allow malicious repository names or descriptions to manipulate the intended behavior of the sync automation.

upstream-fork-sync