The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the gh CLI and curl to retrieve repository and user metadata from GitHub. These operations are essential for its primary function of profile beautification.- [REMOTE_CODE_EXECUTION]: Automated scanners flagged a potential remote code execution pattern involving a pipe to python3. Technical review confirms this is a fallback mechanism in SKILL.md that uses a local Python string (via the -c flag) to parse JSON data fetched from the official GitHub API endpoint. The data is processed as input, not executed as code.- [DATA_EXFILTRATION]: While the skill performs network requests, these are directed at official GitHub APIs to fetch public user information. There is no evidence of local sensitive data (such as credentials or environment variables) being accessed or transmitted.- [PROMPT_INJECTION]: The skill processes external data (GitHub bios and repository descriptions) which could contain indirect prompt injection. However, the scope is limited to document generation, and the impact is mitigated by the intended use case of producing a static README file.

github-profile-beautifier