The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external GitHub issues without sufficient safeguards. * Ingestion points: Issue titles and bodies retrieved via GitHub CLI commands. * Boundary markers: Absent; there are no instructions to the agent to treat external content as potentially untrusted data or use delimiters to prevent instruction hijacking. * Capability inventory: Access to shell execution (Bash), network requests (curl), and GitHub interaction (gh issue comment). * Sanitization: Lacks explicit validation or sanitization steps for data extracted from issue bodies before being used in commands or comments.
[DATA_EXFILTRATION]: The skill performs network requests via curl to URLs parsed from untrusted issue descriptions. * Evidence: The 'P0/P1 Verification Protocol' instructs the agent to extract production URLs from issue bodies and run a curl liveness check. This could be abused for Server-Side Request Forgery (SSRF) if the agent is directed to internal or sensitive endpoints.
[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using externally-sourced variables. * Evidence: Usage of variables like $PROD_URL in curl and $ISSUE_NUMBER in gh commands could lead to command injection if the agent does not properly escape or sanitize the untrusted content.

daily-report