The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Gitea repositories which serves as an attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read data from various Gitea endpoints, including issue descriptions and comments (references/api-issues-prs.md), file contents (references/api-repo.md), and wiki pages (references/api-project.md).
Boundary markers: While Rule 4 in SKILL.md mandates using jq to prevent structural injection into API requests, there are no explicit instructions or delimiters defined to help the agent distinguish between data and embedded instructions within the content it reads.
Capability inventory: The skill provides the agent with extensive capabilities to modify the repository, including writing files, managing branches, creating releases, and updating CI/CD secrets or variables via curl and scripts/gitea.sh.
Sanitization: The skill employs jq -n for building outgoing JSON payloads to mitigate structural injection risks, but it does not include logic to sanitize or filter the semantic content of the data retrieved from the Gitea instance.
[DYNAMIC_EXECUTION]: The skill requires the agent to source a local shell script (scripts/gitea.sh) to provide helper functions. This script uses indirect variable expansion (e.g., ${!var}) to dynamically resolve credentials from environment variables based on the repository's origin.
[COMMAND_EXECUTION]: The skill performs shell command execution using standard system utilities including curl for network requests, jq for JSON processing, and git for repository metadata retrieval. These operations are essential for the skill's functionality but are executed within the agent's shell environment.

gitea