The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides workflow templates that ingest untrusted data from GitHub events and pipe them into LLM prompts.
Ingestion points: The ai-review.yml, issue-triage.yml, and mention-bot.yml templates ingest pull request diffs, issue bodies, and user comments directly into prompts.
Boundary markers: The prompts in SKILL.md (e.g., Sections 1.1, 2.2, 5.1) lack boundary markers or delimiters to separate instructions from untrusted content.
Capability inventory: The associated workflows possess capabilities to create reviews, add labels, and execute Git operations (git push, git rebase) based on AI output.
Sanitization: There is no evidence of sanitization or validation of the external data before interpolation.
[COMMAND_EXECUTION]: The skill utilizes shell commands (git, gh, npm) to interact with the repository, fetch diffs, and perform deployment operations.
[REMOTE_CODE_EXECUTION]: The 'Smart Cherry-Pick' implementation in Section 4.2 relies on AI to resolve code conflicts and then applies those resolutions to the file system. An adversarial conflict could lead to the injection of malicious code into the repository.
[DYNAMIC_EXECUTION]: Section 4.2 describes a process for runtime resolution of code conflicts using AI, which effectively generates code at runtime that is then committed to the codebase.

github-workflow-automation