The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/forge.py uses subprocess.run(..., shell=True) to execute git clone commands. While the input URL is validated against a regular expression, the use of a shell environment for dynamic commands is a security risk that can lead to command injection if validation is bypassed or if shell-specific characters like backticks are included in the input.
[INDIRECT_PROMPT_INJECTION]: The skill aggregates untrusted data (READMEs, code snippets, file trees) from external GitHub repositories into a context_bundle.md file, which is then used as primary context for the AI Agent. This creates a surface for indirect prompt injection attacks.
Ingestion points: scripts/forge.py downloads content from arbitrary repositories via the online_repo_scanner and clone_repository functions.
Boundary markers: The skill uses simple Markdown headers but lacks robust delimiters or instructions to the Agent to ignore embedded commands within the ingested data.
Capability inventory: The skill can execute shell commands and write files, which could be abused if an injection attack succeeds in influencing the Agent's decision-making process.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from remote repositories before it is processed by the Agent.
[REMOTE_CODE_EXECUTION]: The skill's primary function is to download and install third-party code from the internet and prepare it for execution as a skill. This workflow facilitates the execution of unverified remote code on the host system.
[DATA_EXFILTRATION]: The scripts/forge.py script sends API requests that include the user's GITHUB_TOKEN to several unofficial GitHub mirror and proxy domains (e.g., vps.sc, gitmirror.com, 99988866.xyz). Communicating sensitive access tokens to these untrusted third-party services poses a risk of credential exposure.
[EXTERNAL_DOWNLOADS]: The skill performs automated downloads from various third-party domains and mirrors that are not part of the official GitHub infrastructure or recognized trusted vendors.

github-skill-forge