The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the gh-attach extension from a third-party GitHub repository (sudosubin/gh-attach) that is not associated with a trusted organization or well-known service.\n- [REMOTE_CODE_EXECUTION]: By calling gh extension install, the skill downloads and installs executable code from an external source. Although the version is pinned to v0.4.2, the repository belongs to an unverified third party, and the agent executes this code locally to perform uploads and downloads.\n- [CREDENTIALS_UNSAFE]: The skill requires access to the user_session cookie from the user's local browser profile (e.g., Chrome, Firefox, Safari). As noted in the skill's own documentation, this cookie is a full-account credential that grants administrative access to the user's GitHub account. Accessing this sensitive secret via an external extension creates a significant risk of account compromise if the extension is malicious or becomes compromised.\n- [INDIRECT_PROMPT_INJECTION]: The skill features a download capability that allows the agent to fetch content from arbitrary GitHub attachment URLs, creating an ingestion point for untrusted data.\n
Ingestion points: The gh attach download command in SKILL.md allows processing of external files.\n
Boundary markers: The instructions do not define delimiters or provide warnings to ignore embedded instructions within the downloaded files.\n
Capability inventory: The skill can install extensions, execute shell commands via the gh CLI, and write to the local file system.\n
Sanitization: There is no evidence of sanitization, validation, or integrity checking for the downloaded content before or after the agent interacts with it.

gh-attach