The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (!command) in SKILL.md to automatically run shell commands upon loading. Specifically, the commands gh run list --branch $(git rev-parse --abbrev-ref HEAD) and gh run view --branch $(git rev-parse --abbrev-ref HEAD) ... use command substitution to include the current branch name. If a local branch is named using shell metacharacters (e.g., a branch named main; touch exploit), the shell will execute the injected command in the user's environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and analyzes data from external GitHub Actions logs.
Ingestion points: External data enters the agent context via the gh run view command output, which is populated into the <latest_run_details> section of SKILL.md at load time.
Boundary markers: The skill uses XML-style tags (<latest_run_details>) to delimit the data, but it lacks explicit instructions for the agent to ignore potentially malicious instructions embedded within those logs.
Capability inventory: The skill has access to powerful tools including gh api (allowing arbitrary GitHub API calls), git operations, and the EnterPlanMode tool for proposed code modifications.
Sanitization: There is no evidence of log sanitization or filtering to prevent the agent from following instructions hidden in CI logs (e.g., in failing test output or build logs).

fix-pipeline