The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the drogers0/gh-image extension from a third-party GitHub repository. This repository does not belong to a recognized trusted organization or well-known service.
[REMOTE_CODE_EXECUTION]: The skill uses gh extension install to download and execute code from a remote third-party source on the host system. This code is not version-pinned or verified during installation.
[CREDENTIALS_UNSAFE]: The operation requires a GitHub user_session cookie or GH_SESSION_TOKEN. The skill documentation explicitly notes that these tokens grant full account access (not scoped like standard API tokens), which presents a high risk if the third-party extension handles them insecurely or maliciously.
[COMMAND_EXECUTION]: The skill executes various shell commands to install extensions, verify authentication status, and perform image uploads and PR edits.
[DATA_EXPOSURE]: The extension is documented to automatically resolve session cookies from the user's logged-in browser cookie store. This involves accessing sensitive local files containing active session identifiers for GitHub accounts.

gh-image