The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface by ingesting untrusted data from external sources and interpolating it into high-privilege sub-agent prompts.
Ingestion points: Fetches untrusted issue titles and bodies from the GitHub API (Phase 2) and retrieves review comments, inline comments, and PR bodies from GitHub (Phase 6).
Boundary markers: The sub-agent prompts use <issue> and <review_comments> XML-style tags to delimit external data. However, there are no instructions to the sub-agent to ignore potential commands embedded within this data.
Capability inventory: Sub-agents are granted extensive capabilities, including filesystem access, git commit and push operations, and curl network access using the GH_TOKEN (Phase 5).
Sanitization: The skill lacks any explicit sanitization, escaping, or validation logic for the content fetched from GitHub before it is passed to sub-agents.
[CREDENTIALS_UNSAFE]: The skill instructs both the orchestrator and sub-agents to embed the GH_TOKEN directly into the git remote URL (Phase 4, Step 3 and Phase 5, Step 7). This practice causes the sensitive authentication token to be stored in plain text within the repository's .git/config file and potentially logged in shell history.
[COMMAND_EXECUTION]: The skill employs dynamic execution patterns by using node -e to execute one-liner JavaScript snippets for parsing JSON configuration files and extracting authentication tokens (Phase 5, Sub-agent Setup). While used for setup, this increases the complexity of the execution environment.

gh-issues