The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes standard CLI tools including gh, git, node, awk, and python to manage synchronization and configuration tasks.
[DYNAMIC_EXECUTION]:
The file read-config.sh utilizes python -c to parse YAML configuration. This execution is hardened by explicitly stripping the current directory and empty paths from sys.path to prevent hijacking of the yaml module.
The script resolve-platform.sh uses eval for variable indirection. This is secured by a whitelist in a case statement that restricts input to known-safe tokens like 'tracker' or 'vcs'.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests and processes bug reports.
Ingestion points: Bug report markdown files are read by references/bug-doc.js and SKILL.md workflows.
Boundary markers: Sections are delimited using HTML comments (e.g., ) and specific markdown headers.
Capability inventory: The skill can write to the local filesystem and perform issue mutations (create/edit/close) on GitHub via the gh CLI.
Sanitization: Content is sanitized for problematic control characters using references/github-body-text.js, and sensitive environment variables are redacted via references/defer-mutation.js before being used in commands.

sync-github-bug