The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches configuration and template files from various external GitHub repositories using git. While several sources belong to established organizations, the template catalog includes community-maintained repositories such as stevemao/github-issue-templates and dec0dOS/amazing-github-template.
[COMMAND_EXECUTION]: The helper script gh_bootstrap_runtime.py executes system commands via subprocess.run to handle git clone and git checkout operations. These operations are used to manage the lifecycle of templates fetched from the remote sources defined in the catalog.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by parsing project manifest files (e.g., package.json, Cargo.toml, go.mod) to detect project metadata. Malicious content within these files could potentially influence the agent's downstream planning.
Ingestion points: Project manifests and configuration files scanned by scripts/gh_bootstrap_runtime.py in the detect_project function.
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from obeying instructions embedded in the manifest data during the detection phase.
Capability inventory: The skill possesses the ability to write files to the repository and execute git commands through the runtime script.
Sanitization: Content from manifests is parsed as structured data (JSON/TOML) before being used in logic, though the resulting strings are presented to the agent context.

gh-bootstrap