The Agent Skills Directory

[PROMPT_INJECTION]: Surface for Indirect Prompt Injection. The skill processes arbitrary project data through sub-agents (Forker, Sanitizer, Packager) without adequate isolation or instruction protection.
Ingestion points: The skill reads files from any user-defined directory (SOURCE_PATH), which are then provided as context to multiple LLM-based agents.
Boundary markers: The prompts used to invoke the sub-agents interpolate raw project data and paths directly into instruction strings without using delimiters (such as XML tags or triple backticks) or explicitly instructing the agents to ignore embedded commands within the data.
Capability inventory: The skill possesses the capability to execute shell commands, read/write local files, and use the GitHub CLI (gh) to create public repositories and push source code.
Sanitization: There is no evidence of pre-processing or input validation to ensure that project files do not contain adversarial instructions targeting the LLM agents.
[COMMAND_EXECUTION]: The skill executes shell commands to automate repository management and workflow steps.
GitHub CLI Operations: The skill utilizes gh api to retrieve user information and gh repo create --public to publish code. These commands interact with external services and modify repository visibility.
Filesystem Actions: Commands such as mkdir, ls, and cat are used to manage a local staging directory ($HOME/opensource-staging/) and read generated reports.
Argument Injection Risk: The execution of gh repo create in Step 7 incorporates variables like {github_repo} and {description} derived from user input or project analysis. If these inputs are not properly sanitized by the underlying platform, they could represent a surface for command injection.

opensource-pipeline