The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands to retrieve authentication state.
Evidence: scripts/github.ts uses execSync to run gh auth token and gh auth status to retrieve the current user's GitHub session token for API requests.
[EXTERNAL_DOWNLOADS]: The project configuration includes an unpinned dependency from a third-party registry.
Evidence: package.json lists uba-eslint-config with the latest tag. Unpinned dependencies can lead to unpredictable builds and supply chain risks if the remote package is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes raw code content from arbitrary third-party GitHub repositories, which is a vector for indirect prompt injection.
Ingestion points: scripts/github.ts uses the Octokit repos.getContent method to download raw file contents from any repository discovered during the search process.
Boundary markers: scripts/main.ts wraps the retrieved code inside markdown code blocks (```[language]) within the final report, but lacks explicit instructional headers to warn the agent against executing instructions found within the code.
Capability inventory: The skill is capable of fetching up to 100KB of raw text per file across multiple repositories and presenting it for agent analysis.
Sanitization: The formatMarkdownReport function in scripts/main.ts truncates displayed code to the first 40 lines in the visual report, though the underlying logic in fetchCodeFiles processes larger fragments of the source files.

gh-code-search