The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local paths to retrieve authentication tokens and transmits them to a remote Forgejo server.\n
Evidence: scripts/_common.py attempts to read ~/.skillhone/settings.json, ~/.skillhone/identities.conf, and _data/forgejo_config.txt to find the FORGEJO_TOKEN.\n
The ForgejoClient in scripts/forgejo_client.py includes this token in the Authorization header of HTTP requests sent to the user-configured FORGEJO_URL using the requests library.\n
This behavior is essential for the skill's functionality as a VCS management tool and is explicitly documented.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and displays content from the Forgejo API (issues, PRs, and wikis) that may be controlled by third parties.\n
Ingestion points: issue_view in scripts/issue.py, pr_view in scripts/pr.py, and wiki_get in scripts/wiki.py all print untrusted body text to stdout.\n
Capability inventory: The agent can use these scripts to perform write operations (create issues, merge PRs, edit wikis) based on information read from the system.\n
Sanitization: There are no delimiters, escaping, or 'ignore embedded instructions' warnings applied to the data before it enters the agent's context.

forgejo