The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted requirement documents to determine its actions and output.
Ingestion points: Requirements are accepted via text input or file paths specified in the skill arguments (SKILL.md).
Boundary markers: The skill does not implement boundary markers or instructions to the agent to ignore embedded commands within the requirement text.
Capability inventory: The skill utilizes the gh CLI to create issues, create labels, and perform arbitrary API calls with write access to GitHub repositories.
Sanitization: No explicit sanitization or validation of the input requirements is performed before processing.
[COMMAND_EXECUTION]: The skill instructs the agent to generate and execute shell commands that include strings derived from external user input.
Evidence: In Steps 3, 4, and 5, the skill constructs gh issue create and gh api commands using titles and bodies parsed from the user's requirement documents.
Risk: Although the skill provides a warning to quote variables to prevent injection, there is a residual risk that malicious requirement text could exploit the shell environment if the agent or the underlying platform fails to properly escape shell-active characters during command assembly.

create-issue-tree