The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues and Gists which could contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: GitHub issue bodies are retrieved using the gh issue view command (SKILL.md, Step 1), and existing goal capsules are pulled from GitHub Gists using gh gist view (references/pull-goal.md, Step 2).
Boundary markers: The instructions do not define clear delimiters or include warnings to ignore instructions embedded within the external data sources.
Capability inventory: The skill utilizes the gh CLI for network and repository access, performs file system writes to a scratchpad directory, and interacts with the system clipboard via wl-copy.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from issues or Gists before it is used to define the agent's next tasks.
[REMOTE_CODE_EXECUTION]: The skill implements a pattern where it downloads a goal.md file from a user-provided Gist and instructs the agent to "follow it exactly" and "complete it exactly as written." This allows a remote, potentially adversarial source to control the agent's actions through instruction injection.
[COMMAND_EXECUTION]: The skill uses the wl-copy tool to export generated directives to the host system's clipboard. If the underlying data sources (Gists or Issues) are compromised, an attacker could potentially place malicious content or commands into the user's clipboard.

compose-goal