The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions for and implements scripts that read sensitive credential locations, including ~/.ssh/id_ed25519.pub for SSH public keys and ~/.git-credentials for plain-text storage of GitHub Personal Access Tokens.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to configure Git identity, manage SSH keys via ssh-keygen, and extract authentication tokens using grep and sed from local configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection by reading and processing external data from GitHub repositories (e.g., via git ls-remote) and environment variables. It lacks explicit boundary markers to prevent the agent from being influenced by instructions potentially embedded in repository names or metadata. Evidence: Ingestion points in SKILL.md (via git commands) and scripts/gh-env.sh (via curl to GitHub API). Capabilities include full file-write (via git config), network operations (via curl, gh, git), and SSH key generation. Sanitization is minimal, relying on simple sed/grep patterns.

github-auth