The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub issues which could contain malicious instructions designed to influence agent behavior.
Ingestion points: The skill selects target issues based on the output of gh issue list in SKILL.md and user-provided arguments.
Boundary markers: The instructions do not specify any delimiters or instructions to ignore embedded commands when the agent reads and processes issue descriptions.
Capability inventory: The skill has access to powerful tools including shell command execution (Bash), worktree management (EnterWorktree/ExitWorktree), and project task execution (Task), which could be targeted by instructions hidden in external data.
Sanitization: There is no evidence of sanitization or validation of the text fetched from GitHub before it is incorporated into the agent's context.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic context injection syntax (!command) to run shell commands automatically when the skill is loaded.
Evidence: SKILL.md contains several dynamic context placeholders: !git status, !git branch --show-current, !git worktree list, !gh issue list --state open --limit 10, and !gh auth status.
Context: These commands are used to provide the agent with immediate context regarding the git repository and GitHub authentication status. While these are benign development commands, they are executed silently at load time.

resolve-issues