The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the GitHub API (such as usernames, repository names, and label descriptions) and local configuration files, which constitutes a potential attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through GitHub API tool calls (e.g., fetching collaborator lists or webhook details) and by reading the .github/agents/preferences.md file.
Boundary markers: The skill does not explicitly define delimiters or specialized instructions to ignore embedded commands within the data it processes.
Capability inventory: The skill has the ability to modify repository permissions, delete collaborators, change visibility settings, manage webhooks, and write audit reports to the local file system.
Sanitization: There is no evidence of specific sanitization or filtering logic applied to strings retrieved from the GitHub API before they are presented to the user or included in generated reports.
Mitigation: The primary defense is the skill's mandatory "preview and confirm" workflow for every mutation, ensuring a human reviews the planned action before execution.
[SAFE]: The skill implements robust safety rules, including explicit warnings for administrative privilege grants, visibility changes (public/private), and a strict policy against exposing secrets, tokens, or deploy keys in its output.

repo-admin