The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue titles and bodies via the gh issue list command in SKILL.md. This content is then passed to sub-agents for analysis in Step 3 using the template in agent-prompt.md. While the prompt uses structured JSON output and deep analysis instructions to reduce accidental obedience, it lacks explicit boundary markers (e.g., XML tags or delimiters) to separate the untrusted issue text from the agent instructions. An attacker could embed malicious instructions within a GitHub issue to influence the triage report or suggested bulk actions. Findings for this category are always low severity.
Ingestion points: gh issue list --json number,title,body,labels in SKILL.md.
Boundary markers: Absent; issue content is interpolated directly into [Paste the batch of issues here] in agent-prompt.md.
Capability inventory: Uses Bash tool for gh commands and Task tool for sub-agent creation in SKILL.md.
Sanitization: No explicit sanitization or filtering of issue body content before processing.
[COMMAND_EXECUTION]: The skill makes extensive use of the gh CLI via the Bash tool to fetch issues and suggests gh issue close commands in the final report for triage actions. While these are documented as intended functionality for issue management, they represent the execution of external commands based on the analyzed data.

bmad-os-gh-triage