The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, which could contain malicious instructions designed to override agent behavior.
Ingestion points: The skill uses the gh tool to fetch GitHub issue titles, bodies, and comments. It also reads local project files like project-instructions.md and README.md.
Boundary markers: The instructions lack specific delimiters or warnings to treat ingested text as data rather than instructions, which may cause the agent to follow commands embedded in issue comments.
Capability inventory: The agent has access to Bash, Read, Grep, and Glob. The Bash tool allows for general command execution, meaning a successful injection could lead to unauthorized system operations.
Sanitization: No sanitization or validation of the ingested text is performed before it is added to the agent's context.

spec-plan