The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automatically installs the gh-image extension from an external third-party GitHub repository (drogers0/gh-image) if it is not already present.
[REMOTE_CODE_EXECUTION]: By installing and then invoking the gh image command, the skill executes code downloaded from an external source at runtime. The execution of third-party extensions within the GitHub CLI environment can perform arbitrary operations.
[CREDENTIALS_UNSAFE]: The skill is designed to access and utilize the user_session cookie from the local browser's cookie store (e.g., Chrome, Firefox, Keychain). As noted in the skill's own documentation, this cookie grants full account access and is treated as a highly sensitive credential.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by reading untrusted data from external sources and processing it within the agent's context.
Ingestion points: The skill reads the body of GitHub Pull Requests or Issues using the gh pr view or gh issue view commands and stores the content in a variable (BODY).
Boundary markers: There are no boundary markers or instructions to ignore embedded commands used when interpolating this untrusted data into subsequent commands.
Capability inventory: The skill possesses the capability to execute shell commands, install extensions, and modify GitHub repository content (PR/Issue edits and comments).
Sanitization: While the skill uses printf and --body-file - to prevent shell-level injection, it does not sanitize or filter the content for natural language instructions that might redirect the agent's behavior.

github-image-upload