The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides specific exploit payloads that utilize curl | bash patterns to execute remote scripts directly from a URL.
[DATA_EXFILTRATION]: Instructions are provided for exfiltrating the contents of sensitive files (e.g., /proc/self/environ) to an external callback server using curl.
[CREDENTIALS_UNSAFE]: The skill references accessing /proc/self/environ to harvest environment variables, which often contain sensitive credentials like GITHUB_TOKEN or cloud access keys in CI/CD environments.
[COMMAND_EXECUTION]: Recommends the use of external tools like lucky-commit for SHA collisions and subshell execution ($()) to perform unauthorized command execution.
[OBFUSCATION]: Documents various techniques to bypass security filters, including hex-encoded command strings (e.g., $'curl' for curl) and substituting spaces with ${IFS}.
[INDIRECT_PROMPT_INJECTION]: Identifies a significant attack surface where untrusted data from GitHub contexts (branch names, PR bodies) is interpolated into shell steps.
Ingestion points: Target GitHub Actions workflow files (.github/workflows/) that consume context expressions like github.head_ref.
Boundary markers: Vulnerable code snippets lack delimiters; fix patterns use environment variable indirection as a secure boundary.
Capability inventory: Shell run: steps in GitHub Actions workflows that allow for arbitrary command execution.
Sanitization: Vulnerable patterns lack sanitization; the skill recommends environment variable indirection and network runtime monitoring as fixes.
[DYNAMIC_EXECUTION]: Centers on exploiting the dynamic generation of shell scripts in CI/CD pipelines through unsanitized string interpolation of external inputs.
[PRIVILEGE_ESCALATION]: Details how to escalate from low-privilege contexts to full repository compromise using pull_request_target triggers and cache poisoning techniques.

github-actions-script-injection