The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the GitHub API (notification titles, reasons) and interpolates them directly into persistent memory files (memory/MEMORY.md, memory/topics/inbox-triage.md) and notification payloads without sanitization.
Ingestion points: The gh api /notifications command in Step 1 fetches external notification data (titles and subjects).
Boundary markers: No boundary markers or sanitization logic is present to delimit external notification content when writing to memory files or temporary notification files.
Capability inventory: The skill has file-write access and can execute the local ./notify script and the GitHub CLI (gh api).
Sanitization: There is no evidence of filtering or escaping control characters or instructions embedded in notification subjects, allowing an attacker who can trigger a notification to potentially influence the agent's future context.
[COMMAND_EXECUTION]: The skill executes the GitHub CLI (gh api) to interact with the GitHub API and a local utility script (./notify) to send alerts.
Evidence: The skill runs gh api /notifications --paginate 2>&1 in Step 1 to fetch data and ./notify -f .pending-notify-temp/... in Step 8 to send summaries.

inbox-triage