The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to perform its primary functions. The scripts/check_protections.py script executes these commands using the subprocess.run() function. It avoids using the shell=True parameter, which is a key security measure that prevents shell injection attacks even when handling external inputs like repository or branch names.
[INDIRECT_PROMPT_INJECTION]: The skill audits repository settings by fetching data via the GitHub API (such as ruleset names, branch names, and repository metadata). This represents a theoretical attack surface where a malicious repository could contain specially crafted names or descriptions designed to influence the agent's logic. However, the risk is minimal as the audit script primarily outputs status markers (PASS/FAIL) and structured text.
Ingestion points: Repository metadata, ruleset lists, and branch protection details are read via gh api calls in scripts/check_protections.py.
Boundary markers: No explicit delimiters or "ignore instructions" warnings are used when the audit script outputs external data to the agent context.
Capability inventory: The skill uses subprocess.run to call gh for both reading and writing (applying) repository configurations.
Sanitization: There is no evidence of sanitization or escaping of the values returned from the GitHub API before they are printed for the agent to read.

repo-protections