The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external Gitea repositories, such as repository file contents, issue descriptions, and pull request comments. This content is untrusted and represents a surface for indirect prompt injection.
Ingestion points: Repository file contents (SKILL.md), issue and PR bodies or comments (references/api-issues-prs.md), and wiki page content (references/api-project.md).
Boundary markers: Absent. The instructions do not define delimiters or explicit warnings for the agent to treat retrieved forge data as untrusted text.
Capability inventory: Full curl network access, filesystem read and write capabilities, and shell script sourcing.
Sanitization: The skill uses jq for JSON parsing and base64 for file content encoding, but it lacks specific sanitization or filtering for natural language instructions embedded within processed data fields.
[DYNAMIC_EXECUTION]: The skill instructs the agent to generate a shell helper script (/tmp/gitea-helpers.sh) containing function definitions and to source this script in every command block. This pattern involves the runtime creation and execution of code based on templates provided in the skill instructions.
[COMMAND_EXECUTION]: The skill utilizes shell commands, such as git remote get-url origin, to determine the target host and select appropriate credentials. The results of these commands directly drive network probes and credential retrieval logic.
[DATA_EXPOSURE_AND_EXFILTRATION]: The gitea_auto function resolves API tokens by reading environment variables or local files (GITEA_<ALIAS>_TOKEN_FILE). While intended for legitimate credential management and limited to configured aliases, it involves programmatic access to sensitive local secrets.

gitea