The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data retrieved from external GitHub issues, which are controlled by users and may contain malicious instructions.
Ingestion points: In SKILL.md (Step 1 and Step 4) and WORKTREE.md (Fetch issue), the skill retrieves issue titles, bodies, and comments using the gh issue view command.
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to the agent to treat the issue content as untrusted data.
Capability inventory: The skill has broad capabilities, including writing to the local file system, executing repository-specific test/lint commands, and performing git mutations (commit, push) and GitHub actions (PR creation/merging).
Sanitization: There is no evidence of sanitization or filtering of the fetched issue content before it is used to ground the agent's implementation plan.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to interact with the environment and version control system.
Evidence: It explicitly calls git worktree add, git commit, gh pr create, and gh pr merge. Additionally, in SKILL.md Step 5, it instructs the agent to run arbitrary test, lint, and typecheck commands found within the target repository, which could lead to code execution if the repository or the issue-driven changes are malicious.

arc-work-issue