The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves content from external, potentially attacker-controlled sources such as GitHub issue titles, pull request descriptions, and workflow statuses.
Ingestion points: GitHub API endpoints for issues (/repos/{owner}/{repo}/issues), pull requests (/repos/{owner}/{repo}/pulls), actions (/repos/{owner}/{repo}/actions/runs), and workflows.
Boundary markers: None identified. The instructions do not specify delimiters or warnings to ignore instructions embedded in the retrieved GitHub data.
Capability inventory: Extensive write and execution capabilities including file manipulation (cp, rm, mkdir), Git repository modifications (git add, git commit, git push, git reset), and GitHub API interactions (creating issues, PRs, and releases).
Sanitization: No sanitization or validation is performed on the strings retrieved from the GitHub API before they are printed or used in the agent's context.
[CREDENTIALS_UNSAFE]: The gh_sync.sh script handles the GITHUB_TOKEN by writing it to a file at /var/minis/workspace/.git_askpass.sh to support non-interactive Git operations through the GIT_ASKPASS environment variable. While functional for the environment, storing sensitive tokens in a predictable file path on disk creates a risk of exposure if the workspace is shared or if other processes gain read access.
[COMMAND_EXECUTION]: The skill acts as a powerful wrapper for shell commands. It includes instructions for the agent to perform destructive operations such as empty-dir (deleting directory contents), delete-branches (deleting local and remote branches), and push-main (pushing directly to the default branch). Although these require user confirmation flags in the script, the high level of automation increases the risk of accidental or malicious data loss.
[DYNAMIC_EXECUTION]: The script uses python3 -c to execute logic for API requests and JSON parsing at runtime. While the Python code is static and inputs are passed relatively safely via environment variables, this pattern involves the runtime generation and execution of code within the shell wrapper.

github-sync-helper