The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains logic designed to harvest authentication tokens from sensitive local files.
The script in SKILL.md searches for a GITHUB_TOKEN in ~/.hermes/.env and ~/.git-credentials.
Specifically, it uses a sed command to parse and extract plaintext passwords or tokens from stored git remote URLs: GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials 2>/dev/null | head -1 | sed 's|https://[^:]*:$[^@]*$@.*|\1|'). The ~/.git-credentials file is a known sensitive path for credential storage.
[INDIRECT_PROMPT_INJECTION]: The skill implements an "Auto-Fix Loop Pattern" that is vulnerable to instructions embedded in untrusted external data.
Ingestion points: The skill downloads CI logs and reads them using cat ci-logs/*.txt (as described in SKILL.md and references/ci-troubleshooting.md).
Capability inventory: The instructions direct the agent to diagnose errors from these logs and apply fixes using write_file and patch tools followed by a git push operation.
Boundary markers: The skill does not provide boundary markers or instructions to the agent to ignore potentially malicious directions within the log output.
Sanitization: There is no sanitization or validation of the log content before it is processed by the agent to determine code changes.
Risk: An attacker could influence the output of CI tests to inject malicious instructions that the agent would then execute as part of its automated fixing routine.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands and Python snippets to perform git operations, parse JSON data from the GitHub API, and manage files.
[EXTERNAL_DOWNLOADS]: The skill downloads log artifacts and interacts with the official GitHub API at api.github.com. This is an interaction with a well-known service that is consistent with the skill's stated purpose.

github-pr-workflow