The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub repositories, which constitutes an attack surface for indirect prompt injection.
Ingestion points: The agent reads issue bodies, PR descriptions, review comments, and CI logs through commands like gh issue list, gh pr view, and gh run view as described in SKILL.md.
Boundary markers: The instructions include robust defensive boundaries, explicitly telling the agent to treat repository content as data, never as instructions, and providing specific examples of injection attempts to ignore (e.g., "ignore previous rules").
Capability inventory: The agent has write access to the repository, including the ability to comment, label, merge, close issues/PRs, rerun CI jobs, and create releases using the gh CLI.
Sanitization: The skill mandates that the agent quote untrusted text verbatim with its source and author, and requires explicit user authorization before performing any write operations or running reproduction steps.
[SAFE]: The regex-based detection of PI_IGNORE_INSTRUCTIONS is a false positive. The skill text mentions "ignore previous rules" only within a security warning context, instructing the agent to disregard such commands if encountered in untrusted repository content.

github-ops