The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues and pull requests, which is then used to construct prompts for sub-agents, creating a surface for indirect prompt injection.
Ingestion points: GitHub issue content and PR diffs are fetched in SKILL.md using the gh CLI tool.
Boundary markers: The prompts for the sub-agents (Inspector General, Chaos Gremlin, and Standards Auditor) include untrusted work products without explicit sanitization or clear delimiters to prevent the model from following instructions embedded within the reviewed content.
Capability inventory: The skill has the ability to modify the state of GitHub issues and post PR reviews using gh issue edit and gh pr review.
Sanitization: No formal sanitization of external text is performed before it is passed to the sub-agents, although 'Iron Law 01' requires stripping rationales before the final synthesis step.
[COMMAND_EXECUTION]: The skill uses external inputs (issue numbers and idea slugs) directly in shell commands, which could lead to command injection if the inputs are not strictly validated.
In SKILL.md, the {issue-number} provided as an argument is passed directly to gh issue view, gh issue edit, and gh issue comment commands.
While the {idea-slug} is explicitly sanitized (lowercase, spaces to hyphens, special characters removed), the {issue-number} lacks a similar validation step to ensure it is purely numeric before execution.

gremlin