The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various shell commands for git configuration (git config), credential management, and SSH key generation (ssh-keygen). These are standard operations for its stated purpose of setting up developer authentication.
[DATA_EXFILTRATION]: The skill accesses ~/.git-credentials and ~/.ssh/id_ed25519.pub to retrieve existing credentials or display public keys for the user. While these paths are sensitive, they are used locally to facilitate the authentication process as requested by the user. There is no evidence of sending private keys or credentials to unauthorized external domains.
[CREDENTIALS_UNSAFE]: The skill provides instructions for using the git-credential-store helper, which saves tokens in plaintext in ~/.git-credentials. This is a native Git feature but carries inherent risks if the local machine is compromised. The documentation also provides safer alternatives like the cache helper and mentions using .env files for token storage.
[REMOTE_CODE_EXECUTION]: The skill makes API calls to https://api.github.com/user using curl to verify authentication. These calls target a well-known service (GitHub) and are used for identity verification rather than code execution.

github-auth