The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation describes commands that expose sensitive authentication information.
Evidence: references/core.md explains how to use gh auth token and gh auth status --show-token to reveal stored GitHub tokens.
[DATA_EXFILTRATION]: The skill documents workflows for reading sensitive local files and transmitting them to GitHub's servers.
Evidence: references/actions.md provides an example command gh secret set DEPLOY_KEY < ~/.ssh/id_deploy which reads a private SSH key and uploads it as a secret.
Evidence: references/actions.md shows how to bulk-load environment variables from .env files using gh secret set -f .env.
Evidence: references/repo-release.md includes gh repo deploy-key add ~/.ssh/deploy.pub for reading SSH public keys.
[COMMAND_EXECUTION]: The skill provides instructions for using powerful subcommands that can execute arbitrary logic or interact with the shell.
Evidence: SKILL.md describes gh api as an "escape hatch" for arbitrary REST/GraphQL operations.
Evidence: references/core.md documents gh alias set --shell which allows creating aliases that execute through the system shell, supporting pipes and redirection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external GitHub resources that may contain untrusted content.
Ingestion points: Commands like gh pr view, gh issue list, and gh run view --log-failed (which reads CI logs) ingest data from the GitHub platform into the agent's context. (Found in SKILL.md, references/pr.md, references/issues.md, references/actions.md)
Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions embedded in the retrieved content.
Capability inventory: The skill possesses broad capabilities including file read/write, secret management, and network communication via the GitHub API.
Sanitization: There are no documented steps for sanitizing or escaping content retrieved from pull requests, issues, or logs before processing.

gh-cli