The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/github.ts downloads and executes the official @modelcontextprotocol/server-github package from the npm registry at runtime using npx -y.
[COMMAND_EXECUTION]: Uses the Bun runtime to execute a local script and spawn a child process for the GitHub MCP server using the stdio transport.
[DATA_EXFILTRATION]: Accesses the GITHUB_TOKEN environment variable to authenticate requests to the GitHub API, facilitating repository management as described.
[PROMPT_INJECTION]: The skill retrieves external data such as file contents and issue descriptions which could contain malicious instructions (indirect prompt injection surface).
Ingestion points: get-file-contents, get-issue, and get-pull-request in scripts/github.ts.
Boundary markers: None.
Capability inventory: High-privilege GitHub operations including file writing, branch creation, and pull request merging.
Sanitization: None.

github