The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires users to fork and execute an external GitHub repository (maanimis/github-sandbox) that is not from a trusted organization. This repository contains the GitHub Actions workflow that performs the core logic of the skill.
[PRIVILEGE_ESCALATION]: The instructions explicitly direct users to change repository settings to grant GitHub Actions 'Read and write permissions'. This elevated permission level allows the workflow to modify the repository contents and could be abused to exfiltrate data or inject malicious code if the workflow itself is compromised or manipulated.
[COMMAND_EXECUTION]: The skill uses commit messages as inputs for shell commands (curl/wget) within the GitHub Actions runner. The documentation acknowledges this risk by warning users to 'avoid special characters that might break shell parsing,' confirming that user-supplied input is directly interpolated into a command-line context, creating a high risk of command injection.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch arbitrary files from the internet and commit them to a repository. While the examples use example.com, the tool can be used to download and store any external asset, potentially introducing malicious binaries into a development environment.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface where untrusted data (commit messages from any contributor or via pull requests) enters the execution context of the agent's workflow. The absence of boundary markers or explicit sanitization logic for the commit message parsing indicates a vulnerability to indirect injection attacks that could influence the workflow's behavior.

github-sandbox-file-downloader