The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries including gh (GitHub CLI), unzip, and python3. All executions use execFile with arguments passed as an array, which mitigates shell injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub (PR descriptions, comments, and CI logs). It implements several mitigations: 1. A sanitizeForTerminal function in lib.ts strips control characters (C0/C1) from external text to prevent terminal-based attacks. 2. Large text outputs like bodies and logs are truncated by default to prevent context window exhaustion. 3. Ingestion points: GitHub PR metadata, review comments, and job logs are ingested via structured API calls. 4. Boundary markers: Data is processed in structured formats (JSON/GraphQL) and formatted with clear labels before being presented to the agent. 5. Capability inventory: File system writes, network access, and command execution. 6. Sanitization: Control-character filtering is applied to all external strings before logging or display.
[DATA_EXPOSURE]: The skill downloads and stores CI logs in temporary directories. It follows best practices by using mkdtempSync for private directory creation (mode 0700) and ensuring log files are created with restricted permissions (mode 0600) via openSync, O_EXCL, O_NOFOLLOW, and fchmodSync in ci-failures.ts to prevent symlink attacks and local exposure.
[CREDENTIALS_SAFE]: The skill manages GitHub authentication safely by calling gh auth token via lib.ts rather than requiring hardcoded secrets or environment variables. It also includes explicit guidance and logic to prevent leaking tokens during HTTP redirects (302) to external blob storage providers when fetching logs.

gh