The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and acts upon data from external, untrusted sources like GitHub issue bodies and comments.
Ingestion points: Untrusted data enters the context via the github-mcp-server-issue_read tool as described in SKILL.md.
Boundary markers: The workflow lacks delimiters or instructions to treat issue content as data rather than instructions.
Capability inventory: The skill has the capability to execute shell commands (git, npm, gh) and modify local files, which could be exploited if a malicious issue provides 'reproduction steps' that are actually attack commands.
Sanitization: There is no mention of filtering or sanitizing the issue content before it is used to drive development actions.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with the repository and project environment.
Evidence: SKILL.md contains instructions for git grep, git checkout, npm test, and gh pr create.
Context: These commands are essential for the skill's primary purpose of fixing bugs and opening pull requests.

fix-github-issue