The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The SKILL.md file contains a setup check instruction in Step 1 that executes echo "GITHUB_TOKEN: ${GITHUB_TOKEN:-...}". If a token is provided in the environment, this command prints the raw secret to the agent's output and logs, leading to sensitive credential exposure.
[DATA_EXFILTRATION]: The scripts/gather.py script initializes an insecure network environment using ssl._create_unverified_context(). This context is used for all GitHub API requests, effectively disabling SSL certificate validation. This makes the skill vulnerable to Man-in-the-Middle (MitM) attacks where an attacker could intercept the communication, including the GITHUB_TOKEN and the product data being gathered.
[COMMAND_EXECUTION]: The script scripts/gather.py uses subprocess.run to execute git commands for log retrieval. While it uses a list for arguments to mitigate basic shell injection, it executes these commands based on the current working directory, which could be exploited if the agent is directed to a malicious local repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which can influence the agent's behavior:
Ingestion points: In Step 3, the skill fetches commit messages and Pull Request metadata (titles and bodies) from local and remote git repositories.
Boundary markers: The instructions in SKILL.md (Step 4) lack explicit delimiters or instructions to ignore embedded commands when presenting the gathered items to the AI for transformation.
Capability inventory: The skill has permissions to write to the file system (modifying docs/changelog.md) and perform network operations.
Sanitization: There is no evidence of sanitization or validation of the ingested text for prompt injection payloads before it is interpolated into the AI's transformation prompt.

product-update-logger