The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its interaction with external repository data.
Ingestion points: The agent reads untrusted content through commands like gh repo view, gh pr list, and gh issue list in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested GitHub data.
Capability inventory: The skill has significant capabilities including gh pr merge, gh repo create, and gh workflow run which could be abused if the agent is manipulated.
Sanitization: No evidence of validation or sanitization of content retrieved from GitHub repositories before use in subsequent actions.
[DATA_EXFILTRATION]: The setup script handles sensitive identifiers in a manner that could lead to log exposure.
The scripts/setup-github-app.sh script generates a webhook secret using openssl and prints it directly to the terminal output. In an automated or logged environment, this sensitive secret could be exposed in the agent's execution history or system logs.
A configuration manifest containing application details is written to a temporary file at /tmp/github-app-manifest.json.
[COMMAND_EXECUTION]: The skill enables a wide range of GitHub and Azure CLI operations.
While the gh and az commands are the intended function of the skill, they provide an expansive attack surface if the agent's behavior is influenced by malicious data from an external repository.

github-cli