The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from GitHub—specifically label names, project field names, and item values—across multiple phases (L1, L3, P1, P4 in SKILL.md, and via references/labels-api.md and references/projects-api.md). The instructions lack explicit requirements for the agent to use boundary markers or delimiters when presenting or processing this external data, which could allow malicious metadata to influence agent behavior. While the skill mandates URL-encoding for label names, it does not provide comprehensive sanitization. This is significant given the agent's capabilities to perform write and delete operations via the gh api and the mcp__github__projects_list tool.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md (under 'Important Notes') recommend that the agent generate standalone shell scripts for migrations involving more than 100 issues to improve performance and reliability. This generation of executable content based on external and user-provided metadata (such as repo names and labels) represents a dynamic execution surface. If these scripts are executed without human review, they could perform unintended actions if the source data was manipulated.

issue-fields-migration