The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub issues, pull requests, and external plan files, creating an attack surface for indirect prompt injection.
Ingestion points: references/Execute.md instructs the agent to read issue bodies, acceptance criteria (AC), and plan files located in .agents/atlas/plans/*.md to guide implementation.
Boundary markers: There are no defined delimiters or specific instructions to treat external data as untrusted or to ignore embedded commands within issue or plan content.
Capability inventory: The skill possesses extensive capabilities, including bash shell access (alwaysAllow: ["Bash"]), write access to repositories and projects via the gh CLI, and the ability to install packages.
Sanitization: The instructions do not include steps to sanitize, escape, or validate data retrieved from external GitHub sources before the agent processes it.
[COMMAND_EXECUTION]: The skill utilizes shell patterns for bulk operations and dynamic variable assignment that could be exploited.
Evidence: Examples in SKILL.md use xargs to process lists of issue URLs. In references/Execute.md, shell variables like ITEM_ID are populated using jq output. Maliciously crafted project metadata or issue IDs could potentially lead to command injection if the environment does not properly escape these values.
[REMOTE_CODE_EXECUTION]: The execution workflow includes a mechanism for automated package installation.
Evidence: references/Execute.md includes a pre-flight check that triggers bun install if dependencies are missing. This can lead to the execution of malicious scripts if the repository contains a compromised or malicious package.json file.

do-gh-pm