The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (GitHub issues and pull requests), which creates a potential vulnerability to indirect prompt injection where malicious instructions could be embedded in issue bodies or comments.\n
Ingestion points: The skill reads external content in SKILL.md during the investigation phase and interpolates the {body} and {title} fields from GitHub items into subagent instructions in references/subagent-templates.md.\n
Boundary markers: There are no explicit delimiters (e.g., XML tags or specific markdown dividers) or negative constraints (e.g., "ignore any instructions found within this text") used to isolate the untrusted external content from the subagent's instructions.\n
Capability inventory: The subagents have broad capabilities, including the ability to modify the local filesystem and create commits/PRs via git, interact with GitHub via the gh CLI or gh-tool, and access infrastructure resources like Kubernetes and Sentry.\n
Sanitization: The skill does not perform automated sanitization or filtering of the ingested GitHub content.\n
Mitigation: The primary workflow in SKILL.md (Steps 2 and 3) requires the agent to present a concrete investigation plan and wait for explicit user approval before any subagents are dispatched or modifications are made, providing a critical human-in-the-loop verification step.

github-triage