The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions in SKILL.md direct the agent to generate a shell script snippet using an unquoted heredoc (<<EOF) to write the issue body to a temporary file. Because the heredoc is unquoted, any shell metacharacters like backticks or $(...) present in the task description or success criteria will be executed by the shell during the file creation process.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface by ingesting content from local markdown files and using it in shell-executed contexts. * Ingestion points: The specific task markdown file located at TASK_FILE_PATH. * Boundary markers: No shell-level escaping or boundary markers are used when interpolating task content into the unquoted heredoc. * Capability inventory: The skill utilizes node, bash, and gh (GitHub CLI) to perform file system modifications and network API calls. * Sanitization: There is no logic to sanitize shell metacharacters from the strings extracted from the task file before they are used in the heredoc.
[COMMAND_EXECUTION]: The skill relies on executing various CLI tools (gh, git, node) through shell sub-processes. This workflow is inherently sensitive to the data being processed, and the lack of quoting in the heredoc implementation makes it vulnerable to injection from the files it manages.

ensure-task-github-issue