The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (GitHub release notes, RSS feeds, and discussion titles). This creates a vulnerability surface where malicious actors could embed instructions in release notes to influence the AI. However, the skill implements robust mitigations:
Sanitization: The _common.py script contains sanitize_untrusted_text() which uses regex to identify and redact common prompt injection patterns (e.g., 'ignore previous instructions', 'system override', 'DAN').
Boundary Markers: The SKILL.md file explicitly instructs the AI to treat fetched content as 'untrusted external data' and to ignore any instructions found within it.
Size Constraints: Fetched data is truncated (8 KB for release bodies, 5 MB for RSS feeds) to prevent context stuffing attacks.
Capability Inventory: The AI uses the data only to generate a JSON/Markdown digest and backlog candidates, with no capabilities to execute code based on the data or modify remote repositories.
[COMMAND_EXECUTION]: The skill uses Python's subprocess.run to call the GitHub CLI (gh). Analysis of scripts/_common.py shows that command arguments are passed as lists (preventing shell injection) and the repository paths are validated against a strict regex (^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$) before being used.
[EXTERNAL_DOWNLOADS]: The skill fetches data from GitHub and various framework blog RSS feeds. It includes a custom _SafeRedirectHandler in scripts/fetch_rss.py that strictly blocks redirects to non-HTTPS URLs, preventing potential Server-Side Request Forgery (SSRF) to internal services.
[SAFE]: The Static Analysis hint regarding prompt injection in SKILL.md is a false positive; the identified text is a defense mechanism (instructing the AI to ignore untrusted input) rather than an attempt to bypass safety filters.

track-framework-updates