The Agent Skills Directory

[PROMPT_INJECTION]: The 'IRON LAW' section in SKILL.md (lines 6-19) uses absolute authority language ('THIS LAW IS ABSOLUTE AND ADMITS NO EXCEPTIONS') to command the agent to follow user specifications verbatim. This is a common pattern used to bypass system instruction hierarchies and safety filters by prioritizing user input above all other rules.\n- [PRIVILEGE_ESCALATION]: The skill explicitly grants permission for the agent to write to the '/.claude' directory (line 26) for 'plugin/settings fixes'. This allows a project-scoped skill to modify global agent configuration, facilitating operations outside the intended workspace.\n- [PERSISTENCE]: By authorizing writes to hidden home-directory files like '/.claude' (line 26), the skill establishes a mechanism to persist configuration changes or potentially malicious settings that remain active across different projects and agent sessions.\n- [COMMAND_EXECUTION]: The skill provides several bash workflows that include searching sensitive repository internals like the '.git' directory (line 249) and executing filesystem and GitHub CLI mutations based on variables derived from file contents and issue descriptions.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted data.\n
Ingestion points: External data is ingested via 'gh issue view' in SKILL.md (line 271).\n
Boundary markers: None. The skill does not use delimiters or instructions to ignore embedded commands in the issue body.\n
Capability inventory: The skill uses 'gh issue view', 'sed -i', 'git commit', 'find', and 'grep' to modify the repository and GitHub state (lines 134-301).\n
Sanitization: There is no evidence of sanitization or validation for the content extracted from issue bodies before it is used to derive file paths or command arguments (lines 282, 296).

ghe-requirements