The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted data from external GitHub issues and comments. \n
Ingestion points: GitHub issue title, body, and comments are fetched via gh CLI API calls in fetch_issue_data and fetch_issue_comments functions within scripts/inspect_issue.py. \n
Boundary markers: Absent. The skill generates a structured 'Issue Analysis Report' and 'Progress Comment' which include the external content without using clear delimiters or 'ignore' instructions to prevent the model from following embedded malicious commands. \n
Capability inventory: The skill is part of a workflow that performs codebase searches, creates fix plans, writes files, and executes git commands (commits, PRs) after user approval. \n
Sanitization: Partial. While the script uses regex to extract specific fields like error messages and file references, it also passes the raw body and sections to the agent, providing an attack surface where an attacker-controlled GitHub issue could influence agent behavior. \n- [COMMAND_EXECUTION]: The script scripts/inspect_issue.py executes shell commands to interact with git and the gh CLI. \n
Evidence: Functions run_gh_command and find_git_root utilize subprocess.run to call system binaries. \n
Mitigation: The implementation uses a list for arguments and does not enable shell=True, preventing shell injection. Inputs like issue numbers are validated using regex or digit checks before being passed as arguments.

gh-fix-issue