The Agent Skills Directory

Indirect Prompt Injection (HIGH): Templates in templates/rollback-workflow.yml and templates/preview-deployment.yml exhibit vulnerability surfaces where untrusted data is processed with high-privilege write capabilities.
Ingestion points: github.event.inputs.version, github.event.inputs.reason, and github.event.number from GitHub event contexts.
Boundary markers: Absent. Inputs are directly interpolated into commands.
Capability inventory: Write access to repository via git, deployment capabilities via wrangler, and repository interaction via github-script (e.g., commenting on PRs).
Sanitization: Absent. Shell interpolation like VERSION="${{ github.event.inputs.version }}" allows for command injection if an attacker can influence input fields.
Unverifiable Dependencies (MEDIUM): Several external GitHub Actions and tools are used from organizations outside the trusted scope, including:
cloudflare/wrangler-action@v4
oven-sh/setup-bun@v2
slackapi/slack-github-action@v1
codecov/codecov-action@v4
gliech/create-github-secret-action@v1 (Unverified personal repository)
Dynamic Execution (MEDIUM): The use of actions/github-script in templates/preview-deployment.yml and templates/github-actions-full.yml to execute JavaScript logic at runtime increases the attack surface, particularly when combined with the lack of input sanitization mentioned in the injection analysis.
Command Execution (LOW): The scripts/verify-deployment.sh script executes shell commands and performs network requests using curl based on arguments that may be influenced by dynamic workflow variables.

workers-ci-cd