The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly bypass human-in-the-loop confirmation. It states "Do not let the user review first—submit directly and share the URL" (不要先让用户审核——直接提交并分享 URL). This reduces user oversight and overrides standard safety protocols where agents typically seek confirmation before performing external write operations.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting external data and performing actions based on it.
Ingestion points: The skill ingests user conversation text and performs background exploration of the project codebase (referenced as subagent_type=Explore) to gather context.
Boundary markers: The instructions lack technical delimiters or explicit "ignore embedded instructions" warnings for the data gathered during exploration.
Capability inventory: The skill possesses the capability to read files from the filesystem and execute the gh issue create command to write to external repositories.
Sanitization: No explicit sanitization, validation, or filtering of the ingested content is described before the data is passed to the GitHub CLI tool.
[COMMAND_EXECUTION]: The skill uses the gh (GitHub CLI) tool to interact with remote repositories. While this is the intended functionality, the automated execution of gh issue create without a human review step increases the potential impact of unintended command behavior or data placement.

qa