The Agent Skills Directory

Command Execution: The skill uses the gh CLI to interact with GitHub. It specifically recommends writing issue content to a temporary file and using the --body-file flag. This is a defensive programming practice that prevents shell injection attacks or formatting issues that can occur when passing complex user-provided text directly into a command-line argument.
Local File Access: The skill accesses the repository's .github/ISSUE_TEMPLATE/ directory to read templates. This is an expected behavior for its stated purpose. It also manages temporary files on the local file system, ensuring they are removed (rm) after the issue is created.
Indirect Prompt Injection Surface: The skill ingests untrusted data from two sources: user-provided issue details and local repository templates.
Ingestion points: Instructions in SKILL.md direct the agent to read files from .github/ISSUE_TEMPLATE/ and process user requests.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the templates.
Capability inventory: The skill has the capability to execute shell commands (gh, rm), and perform file read/write operations.
Sanitization: The skill mitigates technical command injection by using the --body-file flag rather than direct interpolation into the command string. While the model remains responsible for interpreting the content, the execution environment is protected from typical shell escape sequences.

github-issue-creator