The Agent Skills Directory

External Dependency Installation: The skill provides a command to install the uv package manager via a script from astral.sh. Astral is a well-known service in the Python ecosystem, and this download is a routine step for setting up the required environment.
Indirect Prompt Injection Surface: The skill ingests data from external issue trackers (titles and body content) which is subsequently used as input for title normalization and CVE JSON generation. While the skill includes directives to treat this content as data rather than instructions, the ingestion of untrusted external content represents a potential attack surface.
Ingestion points: Data enters the context through gh issue view commands executed in Step 1 and Step 2.
Boundary markers: The skill contains explicit instructions to the agent to treat external content as data and not instructions.
Capability inventory: The skill possesses the capability to modify issue labels, edit issue bodies, and post comments via the gh CLI, as well as generate Gmail drafts.
Sanitization: The skill employs a Python-based regex cascade to normalize titles, which provides a layer of validation and cleaning for the ingested data.
Dynamic Script Execution: In Step 2, the skill uses a Python heredoc (`python3
<<'PY'`) to execute logic for title normalization. While this script is hardcoded within the skill, the use of dynamic execution for processing data is a consideration for secure implementation.

cve-allocate