The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled Node.js script executes git and gh commands using the spawnSync method. Arguments are passed as an array, which effectively prevents shell command injection by avoiding shell interpretation.\n- [EXTERNAL_DOWNLOADS]: The script clones the rhdh-plugin-export-overlays repository from GitHub. This repository is owned by the skill's authoring organization, making it a legitimate vendor resource for the skill's intended purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes pull request (PR) titles and bodies fetched from GitHub to identify CVE and Jira links. This process involves ingesting external data that could be influenced by third-party contributors.\n
Ingestion points: PR titles and bodies are retrieved in scripts/compute-plugin-package-overlay-cve-list.mjs using the gh pr view command.\n
Boundary markers: The script uses regex filters to extract identifiers rather than relying on structural delimiters for the untrusted content.\n
Capability inventory: The skill possesses the ability to execute git and gh commands and write files to the /tmp directory.\n
Sanitization: Data is passed through a csvEscape function before being written to the final CSV report, which mitigates potential CSV injection attacks.

rhdh-overlay-cve-export