The Agent Skills Directory

Command Execution: The skill utilizes the GitHub CLI (gh) and shell commands to fetch activity data. It also includes a 'pre-flight' check that executes a Python module (setup_preflight) from a local project directory (.apache-magpie-local). These actions are performed to facilitate the skill's data collection and environment verification functions.
Indirect Prompt Injection Surface: The skill processes untrusted external content, including pull request titles, issue bodies, and comments. The skill author has proactively included specific instructions for the agent to treat this content strictly as data and to ignore any embedded instructions, effectively mitigating potential injection attempts.
Shell Injection Prevention: The skill implements defensive coding practices by writing query strings to temporary files and passing them to the GitHub CLI via arguments (e.g., -F query=@/tmp/...) rather than direct interpolation, which protects against command injection vulnerabilities.
Filesystem Access: The skill includes an option to save the generated activity card to a markdown file in the project root, which is a standard feature for generating reports.

activity-sweep