The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to prioritize content provided in user arguments over the skill's internal policies. While the agent is instructed to halt if critical safety constraints (such as mandatory approval for GitHub writes) are violated, this 'override' pattern creates a known surface for instruction bypass or prompt injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from both user-supplied reports and existing GitHub issue content (titles, bodies, and labels). This content influences the output of the decomposition, investigation, and drafting sub-agents.
Ingestion points: User-provided text in report.md and existing issue data fetched via gh issue list and gh issue view in Phases 2 and 6.
Boundary markers: The system uses structured JSON (cases.json, investigation.json) to pass data between agents, but there are no explicit boundary markers or instructions to ignore potential commands embedded within the processed text content.
Capability inventory: The skill possesses capabilities to create and edit GitHub issues, create and manage repository labels, and perform complex GraphQL queries. It also has read-access to the local codebase for automated investigation.
Sanitization: Significant mitigation is provided by a mandatory 'Phase 7' review gate, where the agent must present the final registration plan to the user and obtain explicit approval before any destructive or write operations are executed on GitHub.
[COMMAND_EXECUTION]: The skill relies on the GitHub CLI (gh) for repository interaction. It executes shell commands to perform various tasks, including listing issues, viewing issue details, managing labels, and committing new issues or edits. These commands are dynamically constructed based on the data processed in the earlier phases of the orchestration pipeline.

issue-report-user