The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references a Python script (scripts/fetch_discussions.py) that interacts with the official GitHub GraphQL API (https://api.github.com/graphql). These requests are targeted at a well-known service for legitimate data retrieval and do not represent a security risk.
[COMMAND_EXECUTION]: The skill instructions guide the user to execute a local Python script for data fetching. The script uses only the Python standard library (urllib, json, os) and does not invoke shell commands or download external executables.
[CREDENTIALS_UNSAFE]: The skill requires a GITHUB_TOKEN for API access. It follows security best practices by instructing users to provide this via a .env file rather than hardcoding it, and it correctly scopes the token requirements to read:discussion for public repositories.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (GitHub discussions) which is a potential injection surface. However, it implements safety measures including a 'low signal' guard (Step 1.3) and clear boundary markers for how the agent should treat the data (clustering and evidence extraction only). The risk is assessed as safe due to the read-only nature and lack of downstream high-privilege actions.

github-discussion-to-devrel-content