The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Several commands, including *pro-access-grant, *pro-reset-password, and *pro-validate-login, accept password or new_password as plaintext arguments. This practice exposes sensitive user credentials to the agent's execution context, conversation history, and potentially to system logs.
[PERSISTENCE]: The skill automatically manages a git pre-push hook at .git/hooks/pre-push. This hook intercepts standard git operations and enforces agent-specific restrictions based on environment variables, representing a persistent modification of the user's development environment.
[DYNAMIC_EXECUTION]: The agent is configured to execute local JavaScript scripts (asset-inventory.js, path-analyzer.js, migrate-agent.js) and a unified-activation-pipeline.js fallback script during activation. Additionally, it dynamically constructs and executes shell commands for the CodeRabbit CLI, including platform-specific wrappers for Windows (WSL).
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection by consuming untrusted data from the repository, such as git commit messages, package.json metadata, and handoff artifacts in .aiox/handoffs/. Malicious content in these files could influence the agent's automated workflows, such as pull request creation or release generation.
Ingestion points: Git status output, repository metadata files, and YAML handoff artifacts in .aiox/handoffs/.
Boundary markers: Absent; the agent interprets this data directly to determine suggested next steps and workflow chains.
Capability inventory: Includes git push, gh pr create, npm run scripts, and execution of local .js files via Node.js.
Sanitization: No evidence of sanitization or filtering for the external data ingested from the repository.
[COMMAND_EXECUTION]: The skill executes various potentially dangerous system commands including npm run build/test/lint, git push --force, and GitHub CLI operations. While these are intended for DevOps tasks, they operate with the agent's authority over the remote repository.

aiox-devops