The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the gh CLI to interact with GitHub Projects, Issues, and Pull Requests. It also includes a bash validation script to ensure that generated workflow files adhere to security policies, such as mandatory SHA pinning.
[EXTERNAL_DOWNLOADS]: It generates GitHub Action workflows that reference external repositories. Specifically, it uses the actions/create-github-app-token action from the official GitHub Actions organization and the Fandhe-AI/actions/project-sync action from the vendor's own repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could be manipulated to influence agent behavior.
Ingestion points: Data is retrieved from gh issue view, gh pr view, and gh project item-list in SKILL.md.
Boundary markers: The skill relies on structured JSON output from the gh CLI, providing some structural isolation, but lacks explicit text sanitization.
Capability inventory: Capabilities include writing workflow files to the filesystem and modifying project items via gh project item-edit.
Sanitization: No explicit sanitization or filtering of issue/PR titles or descriptions is performed before they are used in summary tables or comparison logic.

project-sync-issues