The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to parse package names and version numbers from Dependabot commit messages and insert them directly into shell commands (e.g., curl, git grep, git fetch). If a malicious PR contains specially crafted package names or metadata, it could lead to command injection if the agent fails to sanitize the inputs before execution.
[DYNAMIC_EXECUTION]: The skill creates a local git worktree from the PR branch and executes the project's test suite (npm test, pytest, cargo test, etc.). This results in the execution of potentially untrusted code from an external PR branch. Although this is the skill's intended purpose, it constitutes a significant security boundary crossing that relies on the environment's isolation (e.g., a sandbox).
[INDIRECT_PROMPT_INJECTION]: The skill processes data from attacker-controlled sources, including PR commit messages, manifest files, and remote release notes/changelogs. This data is used to influence the agent's workflow and is interpolated into shell commands.
Ingestion points: PR branch (git fetch), commit messages (git log), manifest files (package.json, requirements.txt), and external release notes (api.github.com).
Boundary markers: The instructions lack explicit boundary markers or warnings to ignore malicious instructions embedded in the processed data.
Capability inventory: The skill has extensive shell capabilities including bash, python3, git, and various package managers (npm, pip, cargo, mvn, go).
Sanitization: There is no instruction for the agent to sanitize or validate the parsed package names or version strings before using them in shell commands.
[EXTERNAL_DOWNLOADS]: The skill performs automated network requests to external registries and APIs using curl to fetch package metadata and release notes.
Fetches data from registry.npmjs.org for Node.js packages.
Fetches data from pypi.org for Python packages.
Fetches release information from api.github.com/repos/ and raw.githubusercontent.com.

dependabot-validator