The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill script includes logic to automatically extract GitHub authentication tokens from sensitive local configuration files, specifically ~/.git-credentials and ~/.hermes/.env.
[DATA_EXFILTRATION]: The skill reads highly sensitive files such as ~/.git-credentials to retrieve plain-text credentials. While the token is used for legitimate API calls to a well-known service (GitHub), the unauthorized access to and parsing of the global git credential store is a high-risk behavior.
[INDIRECT_PROMPT_INJECTION]: The skill serves as an ingestion point for untrusted external content by fetching pull request metadata (titles, descriptions) and source code diffs from GitHub. This content is processed to generate review findings and could be used to influence the agent's output or actions.
Ingestion points: Pull request titles, bodies, and file contents retrieved via the GitHub API and git fetch commands in SKILL.md.
Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore' instructions when processing external PR content.
Capability inventory: The skill has the ability to execute shell commands, perform git operations (including checking out remote code), and make network requests to the GitHub API.
Sanitization: No evidence of sanitization or validation of the external PR data was found prior to analysis by the agent.
[COMMAND_EXECUTION]: The skill utilizes multiple shell commands (git, gh, curl, sed, grep, python3) to interact with the local environment and remote APIs, incorporating repository-specific data into these command lines.

github-code-review