The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill extracts GitHub authentication tokens from sensitive local configuration files to authenticate API requests. It specifically targets the global Git credentials file and a skill-specific environment file.
Evidence: Extracts tokens from ~/.hermes/.env and ~/.git-credentials using grep and sed in the setup block of SKILL.md.
[PROMPT_INJECTION]: The skill processes untrusted content from GitHub Pull Requests (titles, descriptions, comments, and diffs), creating an attack surface for indirect prompt injection.
Ingestion points: Reads PR metadata and file contents from the GitHub REST API and local git diff outputs in SKILL.md.
Boundary markers: Absent; instructions do not include delimiters or warnings to ignore embedded instructions in the PR data.
Capability inventory: The skill can execute git commands, curl network requests, and python3 scripts, and it encourages running local test suites (pytest, npm test) on checked-out PR code.
Sanitization: Uses Python's json module for parsing API responses, but checking out and executing code from untrusted PR branches provides a pathway for malicious code execution if tests are run.
[COMMAND_EXECUTION]: Employs shell commands and inline Python scripts to automate code review workflows and process JSON data.
Evidence: Frequent use of curl, git, and python3 -c blocks in SKILL.md to interact with GitHub and the local filesystem.

github-code-review