The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from GitHub issues and pull requests, which could theoretically contain malicious instructions.
Ingestion points: Data is ingested via gh issue list, gh pr view, and various gh api calls within the auditing scripts.
Capability inventory: The skill has the capability to perform write operations to GitHub (comments, merges, repository creation) and execute shell commands.
Boundary markers: Hard Rule 8 in SKILL.md strictly requires the agent to display the exact body of any public post and obtain explicit user approval before execution.
Sanitization: The skill's reference templates (e.g., in references/issue-ops.md) utilize single-quoted heredocs for command bodies to ensure external content is treated as a literal string, effectively preventing command injection.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute local utility and auditing scripts.
Evidence: Scripts such as check-issues.sh, check-security-posture.sh, and repo-scorecard.sh are invoked to audit repository health.
Safety check: These scripts are implemented as read-only tools that exclusively use GET or HEAD requests for GitHub API interactions. Any commands that modify repository settings are emitted as text for the user to review and execute manually, ensuring no autonomous mutation of the environment occurs.

github-ops