The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill is designed to ingest and analyze external security scan reports, which are untrusted data sources. Maliciously crafted reports could attempt to influence the agent's classification or actions (e.g., urging auto-import of findings). The skill mitigates this by:
Ingestion points: Specifically identifying GitHub issues and external report folders as data sources.
Boundary markers: Explicitly instructing the agent to treat all external content as data rather than instructions and enforcing a mandatory one-by-one operator review for every finding.
Capability inventory: Utilizing the gh CLI for creating gists, issue comments, and pull requests, along with local file writes and setup script execution.
Sanitization: Implementing a mandatory "scrubbing" process (Golden Rule 4) to ensure private identifiers like tracker issue numbers or embargoed CVE IDs are removed before publishing reports to public surfaces.
[Local Code Execution]: The "Pre-flight" section executes a Python module (setup_preflight) while modifying the PYTHONPATH to include a local directory (.apache-magpie-local). This pattern is used to verify the skill's execution environment. Users should ensure the local environment and the specified directory contain only authorized configuration scripts.
[External Service Interaction]: The skill uses the gh command-line tool to interact with GitHub infrastructure to fetch scan data, create gists for reporting, and post comments or pull requests. While the skill defaults to creating secret gists and requires operator confirmation before execution, this process involves transmitting triaged security report data to an external service.

issue-import-from-scan