The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external forges which can contain malicious instructions hidden in metadata or text fields.
Ingestion points: The skill reads repository data via commands such as cb issue view, cb pr view, cb repo view, and cb notify list (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat fetched data as untrusted or to ignore embedded commands.
Capability inventory: The agent has the ability to execute shell commands and modify remote state (e.g., cb pr merge, cb issue create, cb api POST), creating a risk if fetched content successfully influences agent behavior (SKILL.md).
Sanitization: The instructions lack guidance on sanitizing or validating external data before it is processed or used in subsequent commands.
[EXTERNAL_DOWNLOADS]: The skill specifies the installation of a third-party Python package from the PyPI registry.
Evidence: Recommends installing codeberg-cli using uv tool install or pip install (SKILL.md).
Context: The package is the standard CLI tool for a well-known open-source hosting service (Codeberg) and its installation is a functional requirement for the skill's operation.

codeberg-cli