The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests unresolved PR comments from GitHub, which are external inputs that could be controlled by unauthorized or malicious actors commenting on a repository.
Ingestion points: Fetches PR review comments and top-level summaries using gh api graphql and gh pr view.
Boundary markers: The skill does not define specific delimiters (like XML tags or markdown blocks) to isolate comment text from instructions, increasing the risk that instructions embedded in a comment might be interpreted by the agent.
Capability inventory: The agent can read local files (path:line), execute shell commands via the gh CLI, and trigger subsequent automated workflows using the tdd skill.
Sanitization: There is no explicit instruction to sanitize, escape, or ignore instructions within the fetched comment bodies.
[COMMAND_EXECUTION]: The skill relies on executing the gh (GitHub CLI) to perform its core functions.
Evidence: Uses gh api graphql to fetch thread data and gh pr view to inspect PR state. While these are legitimate tools for the skill's purpose, they represent a capability to interact with the environment and network.

feedback