The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to read local repository files, including active .env files, to identify necessary configuration steps. This practice exposes existing plaintext secrets to the AI model's processing context.
[COMMAND_EXECUTION]: The skill generates shell scripts (.sh) intended for local execution. The instructions direct the agent to guide the user in granting execution permissions (chmod +x) and running the scripts.
[DATA_EXFILTRATION]: The generated scripts are designed to capture and persist sensitive credentials. While the primary targets are local .env files and GitHub repository secrets via the gh CLI, this functionality creates a pipeline for handling high-value secrets.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted repository content (e.g., README.md, config files) to define its logic. Adversarial content in these files could influence the agent to generate malicious script stages.
Ingestion points: Reads .env, README, and CI workflow configurations from the local repository.
Boundary markers: No delimiters are used to separate repository content from instructions.
Capability inventory: Generates scripts capable of filesystem writes, URL opening, and GitHub CLI interactions.
Sanitization: No validation or sanitization of ingested content is performed before generating script logic.

wizard