The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from external GitHub repositories.
Ingestion points: Data enters the agent context through GitHub tool channels or CLI operations when reading issue/PR bodies, comments, and logs (referenced in SKILL.md and references/body-integrity.md).
Boundary markers: The skill mandates the use of persistent HTML markers () to distinguish agent output and explicitly warns the agent to treat GitHub payloads as untrusted data rather than instructions (SKILL.md, references/identity-and-targets.md).
Capability inventory: The skill can perform authenticated writes to GitHub, including creating or modifying issues, pull requests, comments, and labels via CLI tools like gh api or platform-provided tool channels (references/publication-and-recovery.md).
Sanitization: The instructions explicitly forbid writing back sanitized/decoded text to prevent corruption and provide a script (scripts/decode-sanitized-read.mjs) for safe local decoding of HTML entities for readability purposes.
[SAFE]: The skill includes comprehensive security guidelines that exceed standard practices, such as preventing credential exposure in public comments, verifying assignment separately from creation to prevent silent failures, and maintaining append-only histories to preserve audit trails.

github-operation