The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/github_project_release.py executes shell commands using git and gh (GitHub CLI) tools to manage repository creation, commits, and publishing. Evidence: Usage of subprocess.run to call git init, git commit, git push, and gh repo create. The script uses list-based arguments to prevent shell injection.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as the agent is instructed to read source files from a local project to generate documentation. Ingestion points: scripts/github_project_release.py reads file content in scan_text(), and the LLM reads project files to draft a README as instructed in SKILL.md. Boundary markers: Absent. Capability inventory: Shell command execution (git, gh) and file system access. Sanitization: An audit script scans for credentials and sensitive local paths before publication.
[DATA_EXFILTRATION]: The skill transmits local code to GitHub. While this is the primary functionality, it involves network transmission of local data. The script mitigates risk by auditing for secrets (GitHub and OpenAI tokens) before publication and defaulting to private repository visibility using the user's authenticated gh account.

github-project-release