The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from existing GitHub issues which could contain malicious instructions meant to influence the agent.
Ingestion points: The skill searches and reads titles and bodies of existing issues via the gh issue list command in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to treat external issue content as untrusted data.
Capability inventory: The skill possesses network and write capabilities through gh (GitHub CLI) and the nytid tool, and can read the local filesystem using git.
Sanitization: There are no instructions for sanitizing or escaping the data retrieved from external sources before it is used in further logic or interpolated into prompt templates.
[COMMAND_EXECUTION]: The skill executes shell commands using variables derived from the repository context and proposed issue details.
Evidence: Shell commands like gh issue list --search "<keywords>" and gh issue create --title "<title>" --body-file - in SKILL.md use variables that could be exploited for command injection if the environment (such as existing file names or issue descriptions) contains shell-sensitive characters.

document-issues