The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to scan and read untrusted external content from GitHub issues and discussions. This content is used to classify response types, select templates, and generate drafts. An attacker could potentially include malicious instructions within a GitHub issue or discussion to attempt to influence the agent's classification or drafting behavior.
Ingestion points: The skill fetches data via github-mcp-server-list_issues, github-mcp-server-issue_read, and gh api for discussions.
Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded prompts in the ingested data, though it does require a 'Thread-Read Verification' step.
Capability inventory: The agent generates drafts and prepares gh CLI commands (like gh issue comment or gh api -X DELETE) for human execution.
Sanitization: The instructions do not specify sanitization or escaping of the ingested community content before it is processed by the 'humanizer' skill for drafting.
Command Execution via CLI Fallbacks: The skill utilizes the gh CLI and raw API calls for operations such as listing items, deleting comments, and posting responses. While these are necessary for the skill's functionality, they represent a capability that interacts with external services. The skill includes several mitigations for this risk, such as mandatory audit logging to .squad/comms/audit/ and a strict requirement that the human user performs the final posting action.

external-comms