The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill is designed to gather evidence from external, potentially attacker-controlled sources (such as GitHub issues, pull requests, and CLI tool outputs) and record them in a persistent file (tools/gemini-cli-bot/lessons-learned.md). Because the agent is instructed to synchronize with this file at the start of every session, malicious instructions hidden in the external data could be saved to the ledger and subsequently executed or followed by the agent in future interactions.
Ingestion points: Data enters the system via gh CLI, GraphQL queries, and local scripts as described in the "Detailed Investigation Findings" section.
Boundary markers: The skill template correctly identifies this risk by suggesting that evidence should be wrapped in <untrusted_context> tags to provide a boundary.
Capability inventory: The skill possesses the capability to read and write to the local filesystem (lessons-learned.md) and execute GitHub CLI commands (gh pr view, gh issue view).
Sanitization: While the use of <untrusted_context> tags is a positive security ritual, there is no mention of automated sanitization or filtering to prevent executable commands or injection patterns from being stored in the persistent memory file.

memory