The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub repositories, including PR titles, descriptions, commit messages, and review comments, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Untrusted content is fetched in references/queries.md via gh api and gh pr list commands, specifically targeting the body, title, and commit.message fields.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the fetched data, increasing the risk that the agent may follow instructions contained within the analyzed artifacts.
Capability inventory: The agent utilizes the gh CLI tool and performs file system operations (saving scratch files), which could be targeted by an injection attack.
Sanitization: No sanitization, escaping, or validation logic is defined for the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on shell commands that incorporate user-supplied input via placeholders.
Command Injection Surface: In references/queries.md, variables such as {repo} and {login} are interpolated directly into shell commands (e.g., gh pr list --repo {repo}). If the user provides a maliciously crafted repository name or handle containing shell metacharacters, it could lead to arbitrary command execution depending on the agent's shell execution environment.

github-contribution-retrospective