The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingests untrusted text from GitCode issue descriptions and comments to populate prompts for draft generation.
Ingestion points: Issue body and comments fetched via fetch_issue and fetch_comments in prepare_issue_reply.py.
Boundary markers: Uses delimiters such as "【当前 Issue 内容】" in references/prompts/draft_reply.txt to separate untrusted data.
Capability inventory: The skill can post comments to GitCode repositories using scripts/post_comment.py.
Sanitization: The PromptInjectionDetector in scripts/security_filter.py is explicitly limited to credential leak detection and does not filter for injection patterns. However, the requirement for a human maintainer to review the draft and provide an explicit "Send" command acts as a critical security control.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from non-whitelisted external sources.
Image Downloads: The download_image function in scripts/utils.py downloads images from arbitrary URLs found within GitCode issues using urllib.request.
Knowledge Base Queries: The deepwiki_query function in scripts/utils.py sends repository names and issue snippets to https://mcp.deepwiki.com/mcp to retrieve contextual information.
[COMMAND_EXECUTION]: On Windows platforms, the skill utilizes subprocess.check_output to execute PowerShell commands via the hardcoded path C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. This is used specifically to retrieve the GITCODE_TOKEN from User and Machine environment variables.

gitcode-issue-reply