The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation instructs the agent to execute gh extension install drogers0/gh-image. This command downloads and installs executable code from a third-party personal GitHub repository onto the user's system.
[CREDENTIALS_UNSAFE]: The skill requires the use of a GitHub user_session cookie or GH_SESSION_TOKEN. The documentation explicitly acknowledges that this cookie "grants full account access (not scoped like a PAT)" and should be "treated like a password." Operating with such high-privilege session credentials significantly increases the impact of a potential compromise of the extension or the environment.
[REMOTE_CODE_EXECUTION]: By installing a third-party CLI extension (gh-image), the skill enables the execution of remote code that has not been verified for safety or integrity. The extension's logic handles local file paths and performs network operations, creating a high-risk execution environment.
[COMMAND_EXECUTION]: The skill relies on shell command pipelines (e.g., gh pr view ... | gh pr edit ...) to modify GitHub resources. While it uses --body-file - to mitigate some shell injection risks, it still interpolates data fetched from external PR descriptions into new commands.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill is designed to upload local files to GitHub's internal endpoints. If an attacker can influence the file path provided to the tool, it could be used to exfiltrate sensitive local files to a repository controlled by the attacker.

gh-image