The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Actions logs, creating a surface for indirect prompt injection attacks.
Ingestion points: The commands gh run view <run-id> --log-failed and gh run download <run-id> in SKILL.md ingest logs from external workflow runs. These logs may contain malicious instructions designed to influence the agent's next steps if a failure was triggered by an untrusted actor (e.g., a pull request from a fork).
Boundary markers: The instructions do not define delimiters or specific warnings to the agent to treat the log content as non-authoritative data.
Capability inventory: The skill includes commands to modify the repository, such as git commit, git push, and gh run rerun. A successful injection could leverage these to push unauthorized code or exfiltrate environment details.
Sanitization: There is no evidence of filtering, sanitization, or validation of the log content before it is processed by the agent to 'Identify Root Cause'.
[COMMAND_EXECUTION]: The skill utilizes several high-capability CLI tools to interact with the repository and CI environment.
The skill uses gh (GitHub CLI) to view PRs, download artifacts, and rerun jobs.
The skill uses git to stage changes (git add -A), commit code, and push to remote branches (git push). While these are necessary for the skill's primary purpose, they represent a significant capability surface if the agent is influenced by malicious input.

ci-fix