The Agent Skills Directory

Indirect Prompt Injection Surface: The skill ingests data from external, potentially untrusted sources including issue trackers, email threads, and pull request comments. This is a common pattern for issue-resolution skills but represents a potential vector where instructions could be embedded in the data being processed. The skill mitigates this by requiring user confirmation for all state-changing actions and explicitly instructing the agent to treat external content as data rather than instructions.
Ingestion points: tracker issue body and comments, mail-thread content, and public PR review comments.
Boundary markers: The skill includes an explicit instruction to treat external content as data and to flag potential injection attempts to the user.
Capability inventory: Git operations (commit, push), GitHub CLI operations for PR and issue management, and local file modification.
Sanitization: The skill performs a confidentiality scrub for sensitive terms (CVEs, security-related framing) and requires explicit user approval before any public-facing or state-changing action is executed.
Dynamic Execution of Internal Tools: The skill executes local Python scripts and tools (e.g., setup_preflight and privacy-llm-check) located within the project's own directory structure. These are project-specific utilities used to verify environment state and ensure privacy compliance before processing tasks.
Command Execution: The skill utilizes standard development tools, including the Git binary and the GitHub CLI (gh), to automate workflows such as branch creation, code commits, and pull request management. These operations are performed within the user's local security context and require user oversight for significant steps.

issue-fix