The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources which creates a surface for indirect prompt injection.
Ingestion points: GitHub issue content (comments, labels), repository files (DEFINITION_OF_READY.md, DEFINITION_OF_DONE.md, contribution guidance), and web search results.
Boundary markers: The instructions do not specify any delimiters or safety warnings to treat this external content strictly as data.
Capability inventory: The skill utilizes the GitHub CLI (gh) for remote operations, executes local repository commands (tests, reproductions), performs file system writes in temporary directories and worktrees, and creates pull requests.
Sanitization: No explicit sanitization or validation of the ingested content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is designed to run arbitrary code and commands found within the target repository.
Evidence: Instructions explicitly mandate running "cited reproduction or artifact," "real project commands," "tests," and the "project's completion gate."
[DATA_EXFILTRATION]: The skill's workflow involves sending data derived from the local environment to external services.
Evidence: The workflow requires performing web searches based on "neutral evidence packets" derived from the issue and repository content, effectively sending project-related strings to search engines.

implement-issue