The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted content from GitHub issues and pull requests, creating a surface for indirect prompt injection. Malicious instructions embedded in issue titles or descriptions could influence the agent's behavior when summarizing or reporting on those items.
Ingestion points: Untrusted data is retrieved from external GitHub repositories using search and read tools like mcp_github_github_search_issues and mcp_github_github_issue_read.
Boundary markers: The skill does not define clear delimiters or use instructions to help the agent distinguish between its own logic and the untrusted data it processes during summarization.
Capability inventory: The skill is capable of generating and saving Markdown and HTML files to the workspace, providing a mechanism for persistent injection or stored cross-site scripting (XSS) if data is not sanitized.
Sanitization: There is no evidence of HTML escaping or content validation before writing external data into the generated .html and .md report files.
[DATA_EXFILTRATION]: The skill is configured to search for accessibility labels across all organizations and repositories the user has access to (org:ORGNAME). This broad scope could lead to the unintended inclusion of sensitive information from private repositories into the generated workspace reports.

insiders-a11y-tracker