The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to access highly sensitive local credential files. \n
Evidence: Provides an explicit example for uploading the user's private SSH identity key to GitHub: gh secret set SSH_KEY < ~/.ssh/id_rsa. \n
Evidence: Attempts to extract authentication secrets from ~/.git-credentials and ~/.hermes/.env. \n- [COMMAND_EXECUTION]: The skill employs a pattern of piping network data directly into a programming language interpreter. \n
Evidence: Multiple shell commands in SKILL.md and references/github-api-cheatsheet.md pipe output from curl directly to python3 -c for JSON processing. This pattern is vulnerable if the remote service (GitHub API) returns malicious content intended to exploit the parsing logic. \n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of attacker-controlled data from an external API. \n
Ingestion points: Fetches and displays repository names, descriptions, issue titles, and user metadata from the GitHub API using curl and gh. \n
Boundary markers: None. Data is interpolated directly into printed output without delimiters or instructions for the agent to ignore embedded commands. \n
Capability inventory: The skill has extensive permissions including reading sensitive local files, performing network requests, and executing arbitrary shell commands via gh and git. \n
Sanitization: None. There is no evidence of validation or escaping of the data retrieved from the external API before it is processed or rendered to the user.

github-repo-management