The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands through gh, curl, and ffmpeg to retrieve repository metadata, upload binary data, and transcode video files.
[DATA_EXFILTRATION]: Utilizes curl to transmit local files to https://uploads.github.com. This network operation targets a well-known service as part of the skill's primary functionality for embedding assets into GitHub PRs and issues. The skill also accesses authentication tokens via gh auth token to authorize these requests.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data which creates an injection surface:
Ingestion points: User-provided file paths ($FILE), display names ($NAME), MIME types ($MIME), and repository identifiers interpolated into commands in SKILL.md.
Boundary markers: None provided in the command templates.
Capability inventory: Subprocess execution via Bash for curl, gh, and ffmpeg tools.
Sanitization: None; the skill instructions suggest manual percent-encoding but provide no automated validation.

gh-upload