The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from community PRs and issues to automate management tasks. It is explicitly instructed to act with high autonomy ("Nothing needs the owner"), creating a vulnerability where instructions embedded in a PR title or body could override the skill's logic or the agent's behavior.
Ingestion points: Fetches external content from thedotmack/claude-mem via gh pr list, gh issue list, gh pr view, gh pr diff, and GitHub API comment endpoints (specified in SKILL.md).
Boundary markers: Includes instructions for "merge philosophy" and "hosted-service boundary" checks, along with a manual diff review requirement for CI approval.
Capability inventory: Performs high-impact actions including git merge, gh pr merge, gh api ... /approve (CI run approval), and local execution of test suites via bun test (specified in SKILL.md).
Sanitization: No explicit sanitization, validation, or filtering of external text is performed before processing or interpolation into prompts.
[DYNAMIC_EXECUTION]: The skill executes code from untrusted contributor branches by running bun test and npm install. This dynamic execution of external, potentially malicious code is an inherent risk of the automated triage process described in SKILL.md.
[PRIVILEGE_ESCALATION]: The skill is instructed to approve GitHub Actions CI runs for first-time contributors using gh api -X POST ... /approve. This allows code from external, untrusted forks to execute within the project's CI environment, potentially exposing CI secrets or compute resources.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands (git, gh, npm, bun) to modify the repository state, interact with the GitHub API, and perform merges.
[DATA_EXFILTRATION]: The skill maintains and accesses a ROSTER.md file containing sensitive contributor PII (emails). The combination of PII access and network-capable tools (like gh and git) creates a data exposure risk, despite internal instructions to keep the file private.

community-sweep