The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell command templates with placeholders for user-provided or external values such as <n> (PR number), <owner>, <repo>, <run-id>, and <job_id>. These values are directly interpolated into gh and bash commands. If these inputs are not strictly validated before being executed by the agent, a malicious actor could provide crafted inputs (e.g., 822; rm -rf /) to achieve arbitrary command execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted external data in the form of GitHub Actions logs. An attacker who can influence these logs (e.g., via a PR that triggers the CI) could embed malicious instructions or deceptive text. Since the skill processes these logs to classify failures and generate reports without boundary markers or sanitization, the agent or the user could be manipulated into performing unintended actions based on injected content.
Ingestion points: GitHub Actions logs fetched via gh api repos/<owner>/<repo>/actions/jobs/<job_id>/logs.
Boundary markers: None identified; logs are processed directly via grep and head then passed to the model for classification.
Capability inventory: The skill has access to the Bash, Read, Grep, and Glob tools, enabling file system and command-line operations.
Sanitization: No evidence of escaping or filtering log content to remove potential instructions or control characters.
[EXTERNAL_DOWNLOADS]: The skill fetches log data and metadata from GitHub's official API using the gh command-line tool. While GitHub is a well-known and trusted service, the content of the logs being downloaded is untrusted and attacker-controlled.

ci-debug