The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources by fetching GitHub issue titles and bodies using gh issue view.
Ingestion points: The process described in SKILL.md fetches the full body of target issues using gh issue view {number}, which exposes the agent to content provided by arbitrary GitHub users.
Boundary markers: The skill instructions do not explicitly use delimiters or instructions to ignore embedded prompts within the retrieved issue data. However, the documentation in workshop-guide.md mentions a PostToolUse hook in the delegated triage-agent that performs semantic validation on label applications.
Capability inventory: The skill allows the agent to modify repository metadata through gh issue edit --add-label and explore the filesystem using Read, Glob, and Grep.
Sanitization: No explicit sanitization or escaping of the issue content is defined in the SKILL.md instructions before the agent processes the data.
[DYNAMIC_CONTEXT_INJECTION]: Three shell commands are executed at skill load time via the !command syntax in SKILL.md to populate the prompt with repository metadata, issue counts, and label lists. These are benign read-only operations using the standard gh CLI and do not incorporate user-controlled input.
[COMMAND_EXECUTION]: The skill utilizes the allowed-tools field to restrict shell access to the gh binary (Bash(gh *)). While this provides the agent with write capabilities on GitHub (editing issues), it acts as a security boundary by preventing the execution of arbitrary or unrelated system commands.

triage